joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004765
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10052004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x218], 7
mov esi, 0x104
mov dword [ebp - 0x214], 0x400
push esi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ecx
push eax
push ecx
mov edi, ecx
mov ebx, ecx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
cmp eax, esi
jae 0x10004814
lea eax, [ebp - 0x210]
xor esi, esi
push eax
push 0x20019
push esi
push 0x10001a40
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x10029b59
cmp dword [ebp - 0x210], 0
jne 0x10029c5a
push edi
push esi
push dword [0x10052460]
mov esi, dword [0x10052018]
mov ecx, esi
call dword [0x100532e8]
call esi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100281a0
mov esp, ebp
pop ebp
ret
xor esi, esi
jmp 0x100047dc
push edi
push esi
push dword [0x10052460]
mov esi, dword [0x10052018]
mov ecx, esi
call dword [0x100532e8]
call esi
mov eax, dword [ebp - 0x214]
xor ecx, ecx
mov esi, dword [fcn.10004ca0]
inc eax
push 2
pop edx
shr eax, 1
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push 0
push dword [0x10052460]
mov ecx, esi
call dword [0x100532e8]
call esi
mov edi, eax
xor esi, esi
test edi, edi
je 0x10029bd3
lea eax, [ebp - 0x214]
push eax
push edi
lea eax, [ebp - 0x218]
push eax
push esi
push 0x1000329c
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
cmp eax, 0xea
je 0x10029b59
jmp 0x10029bd6
push 0xe
pop eax
test eax, eax
jne 0x100047dc
cmp dword [ebp - 0x218], 7
jne 0x100047dc
mov esi, edi
cmp word [edi], ax
je 0x10004814
mov edx, dword [ebp - 0x214]
mov ecx, esi
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x21c]
push eax
call fcn.10007162
test eax, eax
js 0x10004814
push 0x100032c4
push esi
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
je 0x10029c52
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
je 0x10029c52
mov eax, dword [ebp - 0x21c]
lea esi, [esi + eax*2]
xor eax, eax
add esi, 2
cmp word [esi], ax
jne 0x10029bf6
jmp 0x10004814
xor ebx, ebx
inc ebx
jmp 0x10004814
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x100047e9
Function at 0x1000481d
Capabilities:
Access pe header
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
push dword [eax + 8]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov ecx, dword fs:[0x30]
mov edx, eax
cmp byte [ecx + 2], 0
jne 0x10004885
test edx, edx
je 0x1000484c
mov eax, dword [edx + 0x60]
sub eax, dword [edx + 0x64]
cmp eax, 0x2000
jb 0x10004885
mov dword [0x100523cc], 0x20e
test edx, edx
je 0x1000488e
mov eax, dword [edx + 0x64]
mov dword [0x100523c8], eax
add eax, 8
cmp eax, 8
jb 0x10029c6b
mov dword [0x100523c4], 0x1004fc80
mov dword [0x100523c0], 0x1004fcb0
ret 8
and dword [0x100523cc], 0
jmp 0x10004856
or eax, 0xffffffff
jmp 0x1000485d
mov dword [0x100523c8], 0xfffffff7
jmp 0x1000486e
Function at 0x1001032a
Capabilities:
Delete file

Disassembly:
mov eax, dword [ecx + 0x18]
test byte [eax + 0xc], 0xc0
je 0x10010339
xor eax, eax
inc eax
ret 4
add eax, 0x30
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_DeleteFileW]
jmp 0x10010336

Function at 0x10010350
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10052004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
jb 0x10010383
ja 0x1003050f
cmp edi, 0x7fffffff
jae 0x1003050f
cmp dword [esi + 0x38], 0
je 0x100103aa
mov eax, dword [esi + 0x18]
test byte [eax + 0x2c], 1
je 0x1003050f
mov eax, dword [eax + 0x28]
cmp edi, eax
ja 0x10010478
cmp edi, dword [esi + 0x3c]
ja 0x10030504
test ebx, ebx
jne 0x1003051b
cmp edi, 0xffffffff
ja 0x1003051b
mov ecx, edi
mov eax, dword [esi + 0x18]
mov dword [eax + 0x24], ecx
mov eax, dword [esi + 0x18]
or dword [eax + 0x2c], 8
cmp dword [esi + 0x38], 0
je 0x100103f2
mov eax, dword [esi + 0x18]
test byte [eax + 0x2c], 1
je 0x10030523
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100281a0
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 4]
lea ecx, [esi + 4]
mov dword [ebp - 0x10], 0
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x14], eax
cmp eax, fcn.10010280
jne 0x10030531
lea eax, [ebp - 0xc]
push eax
push ecx
call fcn.10010280
test eax, eax
js 0x100103df
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp eax, edi
jne 0x1001042e
cmp ecx, ebx
je 0x100103dd
jmp 0x10010430
cmp ecx, ebx
ja 0x10010484
jb 0x10010438
cmp eax, edi
jae 0x10010484
mov eax, dword [esi + 0x18]
test dword [eax + 8], 0x80000
jne 0x10010484
add edi, 0xffffffff
lea eax, [ebp - 0x18]
mov ecx, esi
adc ebx, 0xffffffff
push ebx
push edi
push eax
push 1
lea eax, [ebp - 0x10]
push eax
call fcn.100104c0
test eax, eax
jns 0x100103dd
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100281a0
mov esp, ebp
pop ebp
ret 8
push eax
push edi
call fcn.10025839
jmp 0x100103aa
push ebx
push edi
mov ecx, esi
call fcn.100257da
cmp eax, 0xffffffff
jne 0x1001049a
test edx, edx
je 0x10030546
push dword [esi + 0x20]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetEndOfFile]
test eax, eax
jne 0x100103dd
jmp 0x10030558
push edi
call fcn.100258a1
jmp 0x100103aa
push 1
call fcn.100107a7
jmp 0x100103aa
or ecx, 0xffffffff
jmp 0x100103bd
push 1
mov ecx, esi
call fcn.100107a7
jmp 0x100103f2
lea edx, [ebp - 0xc]
push edx
push ecx
mov ecx, eax
call dword [0x100532e8]
call dword [ebp - 0x14]
jmp 0x1001041a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ecx, eax
call fcn.10004c0d
jmp 0x100103df
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ecx, eax
call fcn.10004c0d
cmp eax, 0x800704c8
je 0x100103dd
test eax, eax
js 0x100103df
jmp 0x100103dd
Function at 0x100104c0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10051420
push 0x10028440
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10052004]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x1c], ecx
mov ebx, dword [ebp + 0x10]
mov dword [ebx], 0
cmp dword [ebp + 0x18], 0
jb 0x1001051e
ja 0x1003058a
cmp ecx, 0x7fffffff
jae 0x1003058a
mov edx, 0x7fffffff
sub edx, ecx
mov eax, 0
sbb eax, dword [ebp + 0x18]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], eax
jb 0x1001054a
ja 0x1003058d
cmp edi, edx
jae 0x1003058d
lea eax, [ecx + edi]
cmp dword [esi + 0x38], 0
je 0x10010574
mov edx, dword [esi + 0x18]
test byte [edx + 0x2c], 1
je 0x1003058d
mov edx, dword [edx + 0x28]
cmp eax, edx
ja 0x1001063d
cmp eax, dword [esi + 0x3c]
ja 0x1003057d
mov edx, dword [esi + 0x38]
test edx, edx
je 0x100105da
mov eax, dword [esi + 0x18]
test byte [eax + 0x2c], 1
je 0x1003059b
mov dword [ebp - 4], 0
push edi
push dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
add eax, edx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
mov dword [ebx], edi
mov eax, dword [esi + 0x18]
or dword [eax + 0x2c], 8
mov edx, dword [esi + 0x18]
mov eax, dword [edx + 0x24]
mov ecx, dword [ebp - 0x1c]
cmp ecx, eax
ja 0x10010631
sub eax, ecx
cmp edi, eax
ja 0x10010631
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [esi + 0x18]
test edx, edx
je 0x100105ee
cmp ecx, dword [edx + 0x18]
jne 0x100105ee
mov eax, dword [ebp + 0x18]
cmp eax, dword [edx + 0x1c]
je 0x10010639
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x34]
push eax
push ebx
push edi
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_WriteFile]
test eax, eax
je 0x100305c9
mov edx, dword [esi + 0x18]
test edx, edx
je 0x100105c4
mov eax, dword [ebx]
xor ecx, ecx
add eax, dword [ebp + 0x14]
adc ecx, dword [ebp + 0x18]
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], ecx
jmp 0x100105c4
lea eax, [ecx + edi]
mov dword [edx + 0x24], eax
jmp 0x100105c4
push 0
jmp 0x10010602
push edx
push eax
mov ecx, esi
call fcn.10025839
mov ecx, dword [ebp + 0x14]
jmp 0x10010574
push eax
mov ecx, esi
call fcn.100258a1
jmp 0x10010646
mov edi, dword [ebp + 0xc]
push 1
mov ecx, esi
call fcn.100107a7
jmp 0x10010646
push 1
mov ecx, esi
call fcn.100107a7
mov ecx, dword [ebp + 0x14]
jmp 0x100105da
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ecx, eax
call fcn.10004c0d
jmp 0x100105c6
Function at 0x10010653
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x14
push esi
mov esi, ecx
test eax, eax
je 0x100305db
mov ecx, dword [esi + 0x18]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
test ecx, ecx
je 0x10010682
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + 0x18]
jne 0x10010682
cmp ebx, dword [ecx + 0x1c]
je 0x100106cd
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0x18]
and dword [ebp - 4], 0
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0x14]
push ecx
push edi
push eax
push dword [ebp + 0x10]
mov dword [ebp - 8], ebx
push dword [esi + 0x20]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_ReadFile]
test eax, eax
je 0x100106e9
mov ecx, dword [edi]
test ecx, ecx
je 0x100106c2
mov edx, dword [esi + 0x18]
test edx, edx
je 0x100106c2
xor eax, eax
add ecx, dword [ebp + 8]
mov dword [edx + 0x18], ecx
adc eax, ebx
mov dword [edx + 0x1c], eax
xor eax, eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov edi, dword [ebp + 0x18]
push 0
push edi
push eax
push dword [ebp + 0x10]
push dword [esi + 0x20]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_ReadFile]
test eax, eax
jne 0x100106a8
jmp 0x100305e8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, 0x26
je 0x100106a8
jmp 0x100305e8
mov eax, dword [ebp + 0x18]
and dword [eax], 0
xor eax, eax
jmp 0x100106c6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ecx, eax
call fcn.10004c0d
jmp 0x100106c4

Function at 0x1001082b
Capabilities:
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
xor ecx, ecx
test byte [ebp + 0xc], 4
mov eax, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
jne 0x10010894
push dword [ebp + 0xc]
push eax
push 1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ecx
push ecx
lea eax, [ebp - 4]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
push eax
push dword [esi + 0x34]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov ecx, 0xc0000000
and eax, ecx
cmp eax, ecx
je 0x1001089b
mov eax, dword [esi + 0x18]
or dword [eax + 0x2c], 1
mov eax, dword [ebp - 4]
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x3c], eax
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x2000
jmp 0x10010849
mov eax, 0x8007000e
jmp 0x1001088d
Function at 0x10010c8c
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ecx + 0x18]
mov ecx, dword [ebp + 0x10]
mov dword [eax], edx
xor eax, eax
mov dword [esi], edx
mov ebx, dword [edi + 0xc]
mov dword [ecx], edx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 4], edi
mov dword [edx], eax
cmp word [edi + 0x30], ax
je 0x10010cbf
and ebx, 0xffffffd9
test bl, 0x20
je 0x10010ccc
mov dword [ecx], 4
jmp 0x10010cec
push 0
pop eax
test bl, 4
je 0x10010cdd
test bl, 2
setne al
inc eax
jmp 0x10010cea
test bl, 2
setne al
lea eax, [eax*2 + 3]
mov dword [ecx], eax
mov edi, dword [edi + 8]
mov ecx, dword [ebp + 8]
and edi, 0x80
mov eax, edi
neg eax
sbb eax, eax
and eax, 0x40000000
add eax, 0x80000000
mov dword [ecx], eax
mov eax, dword [ebp - 4]
test dword [eax + 8], 0x200
je 0x10010d2b
call fcn.10004bbc
test eax, eax
je 0x10010d23
test edi, edi
jne 0x10010d2b
mov dword [esi], 1
jmp 0x10010d31
mov dword [esi], 3
mov ecx, ebx
and ecx, 0xc0
mov eax, ecx
sub eax, 0
je 0x10010d4a
sub eax, 0x40
je 0x10010d8f
sub eax, 0x40
jne 0x10010d50
mov dword [edx], 0x80
test ecx, ecx
setne cl
test bl, 0x10
setne al
test al, cl
je 0x10010d68
or dword [edx], 0x4000000
or dword [esi], 4
test ebx, 0x200
je 0x10010d76
or dword [edx], 0x20000000
pop edi
pop esi
test ebx, 0x400
pop ebx
je 0x10010d87
or dword [edx], 0x4000
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
mov dword [edx], 0x100
jmp 0x10010d50

Function at 0x100113c0
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x30]
call fcn.1001a850
mov ecx, dword [esi + 0x2c]
mov ebx, dword [esi + 0x34]
mov edx, dword [esi + 0x30]
mov dword [ebp - 8], eax
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
test ecx, ecx
jne 0x10011429
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ebx
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 8]
mov eax, dword [eax + 0xf80]
mov dword [eax], edx
mov eax, dword [ecx + 0xc]
mov dword [ecx + 0xc], esi
mov ecx, dword [edi + 0x30]
add ecx, 0x38
mov dword [ebp - 4], eax
call fcn.1000e7b5
lea ecx, [ebp - 8]
call fcn.100057f0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ecx + 8]
sub ecx, 8
jmp 0x100113eb
Function at 0x10011440
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x30]
call fcn.1001a850
mov ecx, dword [ebx + 0x34]
xor esi, esi
mov edx, dword [ebx + 0x30]
mov dword [ebp - 4], ecx
mov ecx, dword [ebx + 0x2c]
mov dword [ebp - 0xc], eax
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
test ecx, ecx
jne 0x100114ce
mov ecx, esi
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp - 4]
mov dword [eax + 0x14], ecx
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [eax + 0xf80]
mov dword [eax], edx
mov eax, dword [ecx + 0xc]
mov dword [ecx + 0xc], ebx
mov ecx, dword [edi + 0x30]
mov dword [ebp - 8], eax
call fcn.1000e427
test eax, eax
js 0x100114d6
mov ecx, dword [edi + 0x30]
mov edx, dword [edi + 0x2c]
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0x10]
mov dword [edx + 0x10], eax
lea ecx, [ebp - 0xc]
call fcn.100057f0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ecx + 8]
sub ecx, 8
jmp 0x10011473
mov esi, 0xc0000055
jmp 0x100114bb
Function at 0x10011840
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x30]
call fcn.1001a850
mov ecx, dword [edi + 0x2c]
mov ebx, dword [edi + 0x34]
mov edx, dword [edi + 0x30]
mov dword [ebp - 8], eax
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
test ecx, ecx
jne 0x10011926
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ebx
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 8]
push 0x124f80
mov eax, dword [eax + 0xf80]
mov dword [eax], edx
mov eax, dword [ecx + 0xc]
mov dword [ecx + 0xc], edi
mov edi, dword [esi + 0x30]
mov dword [ebp - 4], eax
lea ecx, [edi + 0x38]
call fcn.1000e800
mov ebx, eax
test ebx, ebx
js 0x100118b1
mov edx, dword [edi + 0x2c]
test edx, edx
jne 0x10011931
mov edi, dword [ebp + 0x10]
mov dword [edi], ebx
test ebx, ebx
js 0x10011915
mov ecx, dword [esi + 0x30]
mov edx, dword [esi + 0x2c]
push edi
push 0
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0x10]
mov dword [edx + 0x10], eax
mov ebx, dword [esi + 0x28]
mov eax, dword [ebp + 0xc]
lea ecx, [ebx + 0x64]
mov dword [eax], 0
call fcn.1000e86f
cmp dword [edi], 0
jl 0x1001190a
mov ecx, dword [ebx + 0x68]
test ecx, ecx
je 0x10011944
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xf80]
mov eax, dword [eax]
add eax, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov ecx, dword [esi + 0x30]
add ecx, 0x38
call fcn.1000e7b5
lea ecx, [ebp - 8]
call fcn.100057f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ecx + 8]
sub ecx, 8
jmp 0x10011870
mov ecx, dword [edx + 4]
mov eax, dword [ecx]
cmp eax, dword [edx + 8]
je 0x100118b1
jmp 0x10030aeb
xor eax, eax
jmp 0x10011905
mov ecx, edx
call fcn.10028a1b
mov ebx, eax
test ebx, ebx
jns 0x100118b1
lea ecx, [edi + 0x38]
call fcn.1000e7b5
jmp 0x100118b1
Function at 0x10019d30
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
push ebx
push esi
mov esi, ecx
push edi
and dword [esi + 0x14], 0xfffffffe
lea ecx, [esi + 0x48]
mov dword [esi + 4], 0x100018dc
mov dword [esi + 0x10], 0x54535350
mov dword [esi + 0x1c], 1
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 1
mov dword [esi + 0x48], 0
mov eax, dword [eax + 0xf80]
sub ecx, dword [eax]
mov dword [esi + 0x48], ecx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcessId]
mov edi, dword [ebp + 8]
lea ebx, [esi + 0x28]
mov dword [esi + 0x50], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xf80]
mov eax, dword [eax]
mov dword [esi + 0x4c], eax
mov dword [esi + 0x34], 0x10002e58
mov dword [esi + 0x38], 0
mov dword [esi + 0x44], 1
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi], 0x10001850
mov dword [esi + 4], 0x100018f8
mov dword [esi + 0x20], 0x10001968
mov dword [esi + 0x24], 0x10001898
mov dword [ebx], 0x10001940
mov dword [esi + 0x2c], 0x10001914
mov dword [esi + 0x30], 0x10001954
mov ecx, dword [edi + 8]
call fcn.10004416
and dword [esi + 0x70], 0xfffffffe
and eax, 0xfffeffff
mov dword [esi + 0x84], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x68], 0x100018bc
mov dword [esi + 0x6c], 0x1000192c
mov dword [esi + 0x74], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x5c], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x8c], 0
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], eax
lock inc dword [eax + 0x18]
mov dword [esi + 0x64], 1
lea eax, [esi + 4]
mov dword [esi + 0x60], 0x4c464445
mov dword [eax + 4], esi
mov dword [eax + 8], ebx
mov dword [esi + 0x78], eax
mov dword [esi + 0x80], ebx
cmp byte [0x10052028], 0
je 0x10019e92
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
call fcn.1002881b
test al, al
je 0x10019e89
push 0x10001a0c
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test eax, eax
je 0x10019e89
mov eax, dword [esi]
push dword [eax]
push dword [0x10052024]
call dword [sym.imp.ext_ms_win_com_ole32_l1_1_3.dll_StoreQITableEntry]
test eax, eax
mov eax, esi
je 0x10019e8b
pop edi
pop esi
mov byte [0x10052028], 1
pop ebx
pop ebp
ret 0xc
Function at 0x100218f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10052004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x21c], eax
push esi
mov esi, dword [ebp + 0x18]
test eax, eax
je 0x1002a382
and dword [eax], 0
test ecx, ecx
jne 0x1002a38c
mov edx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
mov ecx, edi
call fcn.10021c79
test eax, eax
js 0x100219c1
mov ecx, dword [ebp + 0xc]
xor edx, edx
inc edx
call fcn.10021c16
test eax, eax
js 0x100219c1
call fcn.10006e40
test eax, eax
js 0x100219c1
test esi, esi
je 0x10021979
mov edx, dword [ebp + 0x10]
mov ecx, esi
push 1
call fcn.1002186f
test eax, eax
js 0x100219c1
cmp dword [ebp + 0x10], 3
je 0x1002a3a5
test esi, esi
je 0x1002199d
cmp dword [ebp + 0x10], 5
jne 0x1002199d
cmp word [esi], 2
jb 0x1002199d
cmp dword [esi + 8], 0
jne 0x1002a3e8
push dword [ebp - 0x21c]
xor edx, edx
mov ecx, ebx
push dword [ebp - 0x210]
inc edx
push dword [ebp - 0x214]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.10021a72
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100281a0
mov esp, ebp
pop ebp
ret 0x20
mov eax, 0x80030009
jmp 0x100219c2
push ecx
call dword [sym.imp.api_ms_win_security_base_l1_2_0.dll_IsValidSecurityDescriptor]
test eax, eax
jne 0x1002193b
mov eax, 0x80030057
jmp 0x100219c2
test ebx, ebx
je 0x1002a3c2
mov edx, 0x104
mov ecx, ebx
call fcn.1000713a
test eax, eax
js 0x100219c1
jmp 0x10021983
push 1
lea ecx, [ebp - 0x20c]
call fcn.10004094
test eax, eax
js 0x100219c1
lea ebx, [ebp - 0x20c]
or edi, 0x100
jmp 0x10021983
push dword [esi + 8]
call dword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileAttributesW]
mov dword [ebp - 0x218], eax
cmp eax, 0xffffffff
jne 0x1002a41c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
test eax, eax
jle 0x1002a410
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x100219c1
mov eax, dword [ebp - 0x218]
test eax, 0x4000
je 0x1002199d
call fcn.1002873b
test al, al
je 0x1002a471
test dword [ebp + 0xc], 0x1000
push 0
pop eax
push 0
setne al
push 0x80
inc eax
push eax
push ebx
push dword [esi + 8]
call dword [sym.imp.ext_ms_win_kernel32_file_l1_1_0.dll_DuplicateEncryptionInfoFileExt]
test eax, eax
je 0x1002a466
jle 0x1002a460
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x100219c1
or edi, 0x4000
jmp 0x1002199d
mov eax, 0x800300fa
jmp 0x100219c1
Function at 0x10025aa0
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10052004]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x34]
push 4
push 0x28
push ecx
lea ecx, [ebp - 0x3c]
push ecx
push dword [eax + 0x1c]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x10025ad7
test dword [ebp - 0x14], 0x4000
jne 0x10025ae9
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100281a0
mov esp, ebp
pop ebp
ret 4
xor eax, eax
inc eax
jmp 0x10025ad9
Function at 0x100281d0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x1002820e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x10028206
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x10028210
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x100281f6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x100282f0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x10028306
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x10028321
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x10038012
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10052004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x10052060]
cmp esi, 0xffffffff
jne 0x10038068
push edi
push 0xa
pop ecx
xor edx, edx
lea edi, [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x30], edx
push edx
rep stosd dword es:[edi], eax
push 0x2c
lea eax, [ebp - 0x30]
mov esi, 0x1f4
push eax
push edx
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
pop edi
test eax, eax
js 0x10038062
movsx eax, byte [ebp - 8]
imul esi, eax, 0x1f4
mov dword [0x10052060], esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100281a0
mov esp, ebp
pop ebp
ret