joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009d670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 8], 0
cmp byte [ecx + 0x11], 0
je 0x1009d724
mov esi, dword [ebp + 0xc]
mov edi, ecx
inc esi
lea ebx, [esi - 2]
cmp esi, 2
jae 0x1009d6a1
xor edx, edx
jmp 0x1009d6d0
mov eax, 0xcccccccd
mul dword [edi + 0x28]
mov eax, ebx
mov ecx, edx
xor edx, edx
shr ecx, 2
inc ecx
div ecx
mov eax, dword [0x1017c444]
mov ecx, ebx
sub ecx, edx
xor edx, edx
div dword [edi + 0x24]
xor edx, edx
dec eax
cmp ecx, eax
sete dl
add edx, 2
add edx, ecx
cmp edx, esi
je 0x1009d6e3
mov eax, dword [0x1017c444]
xor edx, edx
div dword [edi + 0x24]
inc eax
cmp esi, eax
jne 0x1009d6e7
inc esi
inc ebx
jmp 0x1009d698
cmp esi, dword [edi + 0x30]
mov edi, 0
ja 0x1009d721
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
push esi
push dword [ebp + 8]
call fcn.100a9c50
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x1009d786
cmp byte [ebp - 1], 4
jne 0x1009d721
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0xc], eax
jne 0x1009d721
mov dword [ebp - 8], esi
lea ebx, [edi + 0x65]
jmp 0x1009d786
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
xor eax, eax
cmp dword [ebp + 0x10], eax
mov edx, 2
mov esi, dword [ebp + 0xc]
cmove eax, edx
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ecx + 0xcc]
push esi
push ecx
call eax
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x1009d786
mov eax, dword [ebp - 0xc]
mov edi, dword [eax + 8]
cmp esi, dword [edi + 4]
je 0x1009d77a
mov ecx, dword [eax + 4]
cmp esi, 1
mov dword [edi + 0x48], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x34], eax
setne al
dec al
mov dword [edi + 0x38], ecx
and al, 0x64
mov dword [edi + 4], esi
mov byte [edi + 9], al
jmp 0x1009d77d
mov ecx, dword [edi + 0x38]
mov eax, dword [ecx]
xor ebx, ebx
bswap eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1009d7a8
mov dword [eax], edi
xor eax, eax
cmp ebx, 0x65
pop edi
cmove ebx, eax
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x1009d80c
mov edx, dword [edi + 0x48]
test byte [edx + 0x1c], 0x20
je 0x1009d803
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.1010cc90
push edx
push eax
mov eax, dword [edi + 0x48]
push esi
call eax
add esp, 0x10
xor eax, eax
cmp ebx, 0x65
cmove ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push edx
call fcn.100d4f60
add esp, 4
xor eax, eax
cmp ebx, 0x65
pop edi
cmove ebx, eax
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100a18c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp + 8], 0
mov al, byte [esi + 0x44]
test al, al
js 0x100a19ae
mov edx, dword [esi + 0x74]
je 0x100a1a20
mov ecx, dword [edx + 0x48]
push ebx
test byte [ecx + 0x1c], 0x20
je 0x100a192c
mov edx, dword [ecx + 0x14]
dec dword [edx + 0x78]
mov eax, dword [edx + 0x88]
mov dword [ecx + 0x10], eax
mov edi, dword [edx + 0x3c]
mov eax, dword [edx + 0x98]
mov dword [edx + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x18]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.1010cc90
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x100a1935
push ecx
call fcn.100d4f60
add esp, 4
mov al, byte [esi + 0x44]
sub al, 1
mov byte [esi + 0x44], al
je 0x100a19a2
nop
movsx eax, al
mov eax, dword [esi + eax*4 + 0x78]
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x100a198f
mov edx, dword [ecx + 0x14]
dec dword [edx + 0x78]
mov eax, dword [edx + 0x88]
mov dword [ecx + 0x10], eax
mov edi, dword [edx + 0x3c]
mov eax, dword [edx + 0x98]
mov dword [edx + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x18]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.1010cc90
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x100a1998
push ecx
call fcn.100d4f60
add esp, 4
mov al, byte [esi + 0x44]
sub al, 1
mov byte [esi + 0x44], al
jne 0x100a1940
mov edx, dword [esi + 0x78]
mov dword [esi + 0x74], edx
pop ebx
jmp 0x100a1a35
mov ecx, dword [esi + 0x40]
test ecx, ecx
jne 0x100a19c1
pop edi
mov byte [esi], 1
mov eax, 0x10
pop esi
pop ebp
ret
mov al, byte [esi]
cmp al, 3
jb 0x100a19ea
cmp al, 4
jne 0x100a19d2
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebp
ret
push dword [esi + 0x10]
call fcn.10068780
mov ecx, dword [esi + 0x40]
add esp, 4
mov dword [esi + 0x10], 0
mov byte [esi], 1
movzx eax, byte [esi + 2]
lea edi, [esi + 0x74]
push eax
mov eax, dword [esi + 8]
push 0
push edi
push ecx
push dword [eax + 4]
call fcn.1009cb40
mov ecx, eax
add esp, 0x14
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x100a1a14
pop edi
mov byte [esi], 1
pop esi
pop ebp
ret
mov edx, dword [edi]
mov byte [esi + 0x44], 0
mov al, byte [edx + 2]
mov byte [esi + 0x45], al
cmp byte [edx], 0
je 0x100a1a8b
movzx eax, byte [edx + 2]
xor ecx, ecx
cmp dword [esi + 0x70], ecx
sete cl
cmp ecx, eax
jne 0x100a1a8b
and byte [esi + 1], 0xf1
xor eax, eax
mov word [esi + 0x46], ax
mov word [esi + 0x32], ax
cmp word [edx + 0x18], ax
jbe 0x100a1a52
mov byte [esi], al
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret
cmp byte [edx + 8], al
jne 0x100a19b5
cmp dword [edx + 4], 1
je 0x100a1a6d
push 0x10160abc
push 0x10b1c
jmp 0x100a1a95
movzx ecx, byte [edx + 9]
mov eax, dword [edx + 0x38]
mov eax, dword [ecx + eax + 8]
bswap eax
push eax
push esi
mov byte [esi], 0
call fcn.100a1640
add esp, 8
pop edi
pop esi
pop ebp
ret
push 0x10160abc
push 0x10b0f
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.10072040
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebp
ret
Function at 0x100ac7f0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push edi
push str.sqlite_master
push edi
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push dword [ebp + 8]
call fcn.100d22f0
add esp, 0x18
cmp dword [ebp + 0x10], 0
jne 0x100ac82d
push edi
push str.sqlite_master
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqlite____AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push dword [ebp + 8]
call fcn.100d22f0
add esp, 0x10
pop edi
pop ebp
ret

Function at 0x100ae960
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 8], str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
mov dword [ebp - 4], str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov edi, dword [esi + ebx*4 + 0x18]
test edi, edi
jne 0x100ae99e
push dword [esi + 8]
push dword [esi + 4]
push dword [ebp + ebx*4 - 8]
push esi
call fcn.100aedd0
mov edi, eax
add esp, 0x10
mov dword [esi + ebx*4 + 0x18], edi
cmp dword [esi + 0x28], 0
jne 0x100aea5f
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 1
push edi
call fcn.1006a570
push edi
call fcn.1006b290
add esp, 0x14
cmp eax, 0x65
jne 0x100ae9f2
mov edx, dword [ebp + 0x10]
mov ecx, str.__parent
test ebx, ebx
mov eax, str.__rowid
cmove eax, ecx
mov ecx, dword [ebp + 0x14]
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push ecx
push edx
push str.Mapping___lld_____lld__missing_from__s_table
push esi
call fcn.100ae880
add esp, 0x1c
jmp 0x100aea4d
cmp eax, 0x64
jne 0x100aea4d
push 0
push edi
call fcn.1006b770
mov ecx, eax
add esp, 8
mov eax, edx
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x18]
cmp ecx, edx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
jne 0x100aea1a
cmp eax, ecx
je 0x100aea4d
push ecx
mov ecx, dword [ebp + 0x14]
test ebx, ebx
push edx
mov edx, dword [ebp + 0x10]
mov eax, str.__rowid
push ecx
push edx
mov dword [ebp + 8], str.__parent
cmove eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
push ecx
push edx
push str.Found___lld_____lld__in__s_table__expected___lld_____lld_
push esi
call fcn.100ae880
add esp, 0x2c
push edi
call fcn.1006bc80
add esp, 4
cmp dword [esi + 0x28], 0
jne 0x100aea5f
mov dword [esi + 0x28], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c5060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
xor edx, edx
push edi
xor edi, edi
mov dword [ebp - 4], edx
cmp dword [eax + 0x14], edx
jle 0x100c511a
push ebx
push esi
nop dword [eax]
mov eax, dword [eax + 0x10]
mov ecx, edi
xor ecx, 1
cmp edi, 2
cmovge ecx, edi
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [ebp - 8], edx
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x100c50fa
mov ebx, dword [eax + ecx*8]
mov esi, edx
mov al, byte [edx]
movzx ecx, byte [ebx]
movzx edx, byte [ecx + 0x10154ac8]
movzx ecx, al
movzx ecx, byte [ecx + 0x10154ac8]
sub ecx, edx
jne 0x100c50e1
sub ebx, esi
nop
test al, al
je 0x100c50f6
movzx ecx, byte [ebx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x10154ac8]
mov al, byte [esi]
movzx ecx, al
movzx ecx, byte [ecx + 0x10154ac8]
sub ecx, edx
je 0x100c50c0
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
inc edi
cmp edi, dword [eax + 0x14]
jl 0x100c5080
pop esi
pop ebx
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x100c50e1
mov eax, dword [ebp - 8]
push 0
push dword [ebp + 0xc]
add eax, 0x18
push eax
call fcn.1008a1a0
add esp, 0xc
mov edx, dword [eax + 8]
mov dword [ebp - 4], edx
test edx, edx
jne 0x100c50ed
jmp 0x100c50e4
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x100c5130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
nop
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [edx + 0x14], eax
jle 0x100c51fd
mov ebx, eax
xor ebx, 1
cmp eax, 2
cmovge ebx, eax
test edi, edi
je 0x100c51c0
mov eax, dword [edx + 0x10]
mov ecx, ebx
add ecx, ecx
mov esi, edi
mov edx, dword [eax + ecx*8]
mov al, byte [edi]
movzx ecx, al
movzx edi, byte [ecx + 0x10154ac8]
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x10154ac8]
sub edi, ecx
jne 0x100c51e4
sub edx, dword [ebp + 0x10]
mov dword [ebp - 8], edx
nop dword [eax]
test al, al
je 0x100c51b6
movzx ecx, byte [edx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x10154ac8]
mov al, byte [esi]
movzx ecx, al
movzx edi, byte [ecx + 0x10154ac8]
sub edi, edx
mov edx, dword [ebp - 8]
je 0x100c5190
jmp 0x100c51e4
test edi, edi
jne 0x100c51e4
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
shl ebx, 4
push 0
push ecx
mov eax, dword [ebx + eax + 0xc]
add eax, 8
push eax
call fcn.1008a1a0
add esp, 0xc
mov eax, dword [eax + 8]
test eax, eax
jne 0x100c52ad
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
inc eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
cmp eax, dword [edx + 0x14]
jl 0x100c5151
mov dl, byte [ecx]
movzx eax, dl
cmp byte [eax + 0x10154ac8], 0x73
jne 0x100c52ab
mov esi, str.sqlite_master
sub esi, ecx
test dl, dl
je 0x100c523f
movzx eax, byte [esi + ecx + 1]
inc ecx
mov dword [ebp + 0xc], ecx
mov dl, byte [ecx]
movzx ecx, byte [eax + 0x10154ac8]
movzx eax, dl
movzx eax, byte [eax + 0x10154ac8]
sub eax, ecx
jne 0x100c52ab
mov ecx, dword [ebp + 0xc]
jmp 0x100c5216
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov eax, dword [eax + 0x10]
mov edx, dword [eax + 0x10]
test edi, edi
jne 0x100c5255
neg edx
sbb edx, edx
jmp 0x100c529a
test edx, edx
je 0x100c52ab
movzx eax, byte [edx]
mov esi, edi
mov bl, byte [edi]
movzx ecx, byte [eax + 0x10154ac8]
movzx eax, bl
movzx eax, byte [eax + 0x10154ac8]
sub eax, ecx
jne 0x100c5298
sub edx, edi
test bl, bl
je 0x100c5298
movzx eax, byte [edx + esi + 1]
inc esi
movzx ecx, byte [eax + 0x10154ac8]
mov bl, byte [esi]
movzx eax, bl
movzx eax, byte [eax + 0x10154ac8]
sub eax, ecx
je 0x100c5277
mov edx, eax
test edx, edx
jne 0x100c52ab
mov ecx, str.sqlite_temp_master
mov dword [ebp + 0xc], ecx
jmp 0x100c5140
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100fb2a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x30]
test eax, eax
je 0x100fb378
cmp dword [eax + 0x18], 0
je 0x100fb369
push ebx
mov ebx, dword [eax]
push esi
push 0
push 0x14
mov dword [ebx], 0
call fcn.100d1bf0
mov esi, eax
add esp, 8
test esi, esi
jne 0x100fb2e0
lea eax, [esi + 7]
pop esi
pop ebx
pop edi
pop ebp
ret
cmp dword [0x1017c90c], 0
je 0x100fb328
mov eax, dword [0x1017ca0c]
test eax, eax
je 0x100fb300
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x100fb328
lea eax, [esi + 4]
mov dword [esi + 8], 0x100fb220
push eax
push 0
push esi
push 0x100df9a0
push 0
push 0
mov dword [esi + 0xc], edi
call fcn.10128763
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x100fb335
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x100fb360
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
push edi
mov dword [esi + 4], eax
call fcn.100fb380
mov ecx, eax
add esp, 8
mov eax, dword [edi + 0x30]
mov eax, dword [eax]
mov dword [eax + 4], 1
mov dword [esi + 0x10], ecx
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
ret
push dword [ebp + 0xc]
push edi
call fcn.100fb380
add esp, 8
pop edi
pop ebp
ret
xor eax, eax
pop edi
pop ebp
ret
Function at 0x100fb490
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
push esi
push edi
xor edi, edi
movlpd qword [ebp - 8], xmm0
mov eax, dword [ebx + 4]
cmp eax, dword [ebx + 0xc]
jl 0x100fb60f
jg 0x100fb4bf
mov eax, dword [ebx]
cmp eax, dword [ebx + 8]
jb 0x100fb60f
mov esi, dword [ebx + 0x30]
test esi, esi
je 0x100fb63b
cmp dword [esi + 0x18], edi
je 0x100fb5c3
push dword [esi]
call fcn.100fc470
mov edi, eax
add esp, 4
test edi, edi
jne 0x100fb5be
movups xmm0, xmmword [esi + 0x30]
lea ecx, [esi + 0x20]
movups xmm1, xmmword [ecx]
movups xmmword [ecx], xmm0
mov eax, dword [esi + 0x28]
movups xmmword [esi + 0x30], xmm1
cmp eax, dword [esi + 8]
jne 0x100fb514
mov eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0xc]
jne 0x100fb514
mov dword [esi + 0x14], 1
jmp 0x100fb5f3
mov eax, dword [esi]
push 0
push 0x14
mov dword [ebp + 8], eax
mov dword [eax], 0
call fcn.100d1bf0
mov edi, eax
add esp, 8
test edi, edi
jne 0x100fb53c
lea edi, [eax + 7]
lea ecx, [esi + 0x20]
jmp 0x100fb5ef
cmp dword [0x1017c90c], 0
je 0x100fb584
mov eax, dword [0x1017ca0c]
test eax, eax
je 0x100fb55c
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x100fb584
lea eax, [edi + 4]
mov dword [edi + 8], 0x100fa700
push eax
push 0
push edi
push 0x100df9a0
push 0
push 0
mov dword [edi + 0xc], esi
call fcn.10128763
add esp, 0x18
mov dword [edi], eax
test eax, eax
jne 0x100fb591
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
cmp dword [edi + 8], 0
jne 0x100fb5b7
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
mov dword [edi + 4], eax
call fcn.100fa540
mov ecx, eax
add esp, 4
mov eax, dword [esi]
mov dword [eax + 4], 1
mov dword [edi + 0x10], ecx
mov eax, dword [ebp + 8]
mov dword [eax], edi
xor edi, edi
lea ecx, [esi + 0x20]
jmp 0x100fb5ef
push esi
call fcn.100fa540
movups xmm0, xmmword [esi + 0x30]
lea ecx, [esi + 0x20]
mov edi, eax
add esp, 4
movups xmmword [ecx], xmm0
mov eax, dword [esi + 0x28]
cmp eax, dword [esi + 8]
jne 0x100fb5ef
mov eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0xc]
jne 0x100fb5ef
mov dword [esi + 0x14], 1
test edi, edi
jne 0x100fb63b
cmp dword [esi + 0x14], 0
jne 0x100fb63b
push dword [esi + 0xc]
push dword [esi + 8]
push ecx
push ebx
push dword [esi]
call fcn.100fb650
add esp, 0x14
test eax, eax
jne 0x100fb634
lea eax, [ebp - 8]
push eax
push ebx
call fcn.100fb140
add esp, 8
test eax, eax
jne 0x100fb634
mov ecx, dword [ebp - 8]
lea eax, [ebx + 0x20]
push eax
push ecx
push ebx
mov dword [ebx + 0x14], ecx
call fcn.100fafa0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call fcn.100fb250
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100fc1f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
xor edi, edi
movzx ecx, byte [ebx + 0x3b]
dec ecx
mov byte [ebx + 0x38], 1
mov dword [ebp + 8], ecx
test ecx, ecx
jle 0x100fc248
nop dword [eax]
movzx eax, byte [ebx + 0x3a]
inc eax
add eax, edi
cdq
idiv ecx
lea esi, [edx + 1]
lea esi, [edx + esi*8]
cmp dword [ebx + esi*8 + 4], 0
lea esi, [ebx + esi*8]
je 0x100fc23e
push esi
call fcn.100fc470
add esp, 4
test eax, eax
jne 0x100fc356
mov ecx, dword [ebp + 8]
cmp dword [esi], 0
je 0x100fc248
inc edi
cmp edi, ecx
jl 0x100fc210
lea eax, [ebx + 0x24]
cmp edi, ecx
jne 0x100fc267
push eax
lea eax, [ecx + 1]
lea eax, [ecx + eax*8]
lea eax, [ebx + eax*8]
push eax
call fcn.100fc4f0
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
mov edi, dword [esi + 0x14]
mov ecx, esi
movq xmm0, qword [ebx + 0x24]
sub ecx, ebx
sub ecx, 0x40
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [ebx + 0x3a], al
movq qword [esi + 0x10], xmm0
mov eax, dword [ebx + 0x2c]
mov dword [esi + 0x18], eax
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x2c], 0
test edi, edi
je 0x100fc35b
push edi
mov dword [ebx + 0x28], edi
call dword [0x1017c940]
add esp, 4
mov dword [ebx + 0x34], eax
push 0
push 0x14
mov dword [esi], 0
call fcn.100d1bf0
mov edi, eax
add esp, 8
test edi, edi
je 0x100fc37e
cmp dword [0x1017c90c], 0
je 0x100fc31f
mov eax, dword [0x1017ca0c]
test eax, eax
je 0x100fc2f7
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x100fc31f
lea eax, [edi + 4]
mov dword [edi + 8], 0x100fc390
push eax
push 0
push edi
push 0x100df9a0
push 0
push 0
mov dword [edi + 0xc], esi
call fcn.10128763
add esp, 0x18
mov dword [edi], eax
test eax, eax
jne 0x100fc32c
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
cmp dword [edi + 8], 0
jne 0x100fc352
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [edi + 4], eax
lea eax, [esi + 0x10]
push eax
push esi
call fcn.100fc4f0
mov dword [esi + 4], 1
add esp, 8
mov dword [edi + 0x10], eax
mov dword [esi], edi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp dword [ebx + 0x28], 0
je 0x100fc2bb
mov eax, dword [ebx + 0x34]
cdq
push edx
push eax
call fcn.100d1bf0
add esp, 8
mov dword [ebx + 0x28], eax
test eax, eax
jne 0x100fc2bb
pop edi
pop esi
mov eax, 7
pop ebx
pop ebp
ret
Function at 0x1010ee50
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x101811b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2ec], ebx
push edi
test ebx, ebx
je 0x1010f054
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1010f054
push esi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.10117810
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x2d8]
add esp, 0xc
push eax
push 8
push 0
push 0x10162160
push 0x80000002
call esi
test eax, eax
jne 0x1010f029
xor edi, edi
mov dword [ebp - 0x2dc], 0x104
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x1d0]
push eax
push edi
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1010f018
lea eax, [ebp - 0x2e0]
push eax
push 1
push 0
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0x2d8]
call esi
test eax, eax
jne 0x1010efe2
lea eax, [ebp - 0x2e4]
mov dword [ebp - 0x2e8], 1
push eax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x2e4], 0x104
push eax
lea eax, [ebp - 0x2e8]
push eax
push 0
push 0x1016219c
push dword [ebp - 0x2e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1010efda
push 0x64
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.10117810
push 0x64
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.1010f070
add esp, 0x18
test eax, eax
je 0x1010efda
cmp byte [ebp - 0x68], 0
je 0x1010ef9c
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x1010efda
lea ecx, [ebp - 0x68]
mov edx, 0x64
lea esi, [ebp - 0xcc]
mov eax, ecx
sub esi, eax
nop
lea eax, [edx + 0x7fffff9a]
test eax, eax
je 0x1010efc9
mov al, byte [esi + ecx]
test al, al
je 0x1010efc9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x1010efb0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov byte [eax], 0
push dword [ebp - 0x2e0]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x2dc], 0x104
push eax
lea eax, [ebp - 0x1d0]
inc edi
push eax
push edi
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1010eef0
push dword [ebp - 0x2d8]
call ebx
mov ebx, dword [ebp - 0x2ec]
mov edi, dword [ebp + 0xc]
cmp byte [ebp - 0x68], 0
pop esi
je 0x1010f054
lea eax, [ebp - 0x68]
push eax
push edi
push ebx
call fcn.101100f0
xor ecx, ecx
test eax, eax
pop edi
setns cl
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010c1dc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.1010c1dc
mov esp, ebp
pop ebp
ret
Function at 0x1010f190
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x101811b8]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1010f30f
cmp dword [ebp + 0xc], 0x20
jb 0x1010f30f
push 0x400
lea eax, [ebp - 0x504]
mov dword [ebp - 0x50c], 1
push 0
push eax
mov dword [ebp - 0x508], 0x400
call fcn.10117810
add esp, 0xc
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x50c]
push eax
push 0x10162208
push str.Software360SafeLiveup
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x1010f30f
lea ecx, [ebp - 0x504]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1010f220
sub ecx, edx
cmp ecx, 0x40
jne 0x1010f30f
lea edx, [ecx + 0x40]
push esi
lea ecx, [ebp - 0x84]
lea esi, [ebp - 0x504]
mov eax, ecx
sub esi, eax
lea eax, [edx - 0x60]
test eax, eax
je 0x1010f25c
mov al, byte [esi + ecx]
test al, al
je 0x1010f25c
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x1010f246
test edx, edx
lea eax, [ecx - 1]
lea esi, [ebp - 0x4e4]
mov edx, 0x80
cmovne eax, ecx
lea ecx, [ebp - 0x104]
mov byte [eax], 0
mov eax, ecx
sub esi, eax
nop dword [eax]
lea eax, [edx + 0x7fffff7e]
test eax, eax
je 0x1010f299
mov al, byte [esi + ecx]
test al, al
je 0x1010f299
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x1010f280
test edx, edx
lea eax, [ecx - 1]
push 0x400
cmovne eax, ecx
push 0
mov byte [eax], 0
lea eax, [ebp - 0x504]
push eax
call fcn.10117810
push 0x400
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.1010f320
add esp, 0x18
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
test eax, eax
jne 0x1010f30f
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0xc]
push edi
call fcn.101100f0
neg eax
pop edi
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010c1dc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.1010c1dc
mov esp, ebp
pop ebp
ret