joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53780e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5c9030]
jne 0x537818
repz ret
jmp fcn.00540cb3

Function at 0x54d998
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c9030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.005406db
and dword [ebp - 0x14], 0
cmp dword [0x5d1384], 0
mov dword [ebp - 0x18], eax
jne 0x54da4b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x54daf3
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x596168
push ebx
call edi
test eax, eax
je 0x54daf3
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x596158
push ebx
mov dword [0x5d1384], eax
call edi
push eax
call esi
push 0x596144
push ebx
mov dword [0x5d1388], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5d138c], eax
call edi
push eax
call esi
mov dword [0x5d1394], eax
test eax, eax
je 0x54da4b
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5d1390], eax
mov eax, dword [0x5d1390]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x54daa4
cmp dword [0x5d1394], ecx
je 0x54daa4
push eax
call esi
push dword [0x5d1394]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x54daa4
test ebx, ebx
je 0x54daa4
call edi
test eax, eax
je 0x54da9b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x54da9b
test byte [ebp - 8], 1
jne 0x54daa4
or dword [ebp + 0x10], 0x200000
jmp 0x54dad7
mov eax, dword [0x5d1388]
cmp eax, dword [ebp - 0x18]
je 0x54dad7
push eax
call esi
test eax, eax
je 0x54dad7
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x54dad7
mov eax, dword [0x5d138c]
cmp eax, dword [ebp - 0x18]
je 0x54dad7
push eax
call esi
test eax, eax
je 0x54dad7
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5d1384]
call esi
test eax, eax
je 0x54daf3
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x54daf5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053780e
leave
ret

Function at 0x580bd6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x580bd6
lcall 0x5de5, 0x8b10c483
jmp loc.00fabfc4
Function at 0x1013ad00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1013ad2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1013ad2d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x7d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d806a
add dl, dl
jne 0x7d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d80dc
xor eax, eax
add dl, dl
jne 0x7d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d817d
add dl, dl
jne 0x7d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7d8075
mov eax, 1
add dl, dl
jne 0x7d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d80e1
sub eax, ebx
mov ebx, 1
jne 0x7d8128
mov ecx, 1
add dl, dl
jne 0x7d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8136
cmp eax, 0x7d00
jae 0x7d816d
cmp eax, 0x500
jb 0x7d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
cmp eax, 0x7f
ja 0x7d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x401443
pop dword [ebp - 0xc]
mov eax, 0xb5070037
add eax, 0x4b39140c
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xf41f44ca
add dword [ebp - 0x1c], 0x5a330081
mov dword [ebp - 0x18], 0x7cbd918f
add dword [ebp - 0x18], 0xb575bab6
mov dword [ebp - 0x14], 0x9bdd4899
add dword [ebp - 0x14], 0xb06efb95
mov dword [ebp - 0x10], 0x666532ae
add dword [ebp - 0x10], 0x999acd52
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x83ab8ee8
sub eax, 0x836b0de4
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xabe3a3e4
add dword [ebp - 0x1c], 0xc88ec572
mov dword [ebp - 0x18], 0x55c19a17
sub dword [ebp - 0x18], 0x145538a2
mov dword [ebp - 0x14], 0x723127d5
sub dword [ebp - 0x14], 0xec1bb69
mov dword [ebp - 0x10], 0xa043150
sub dword [ebp - 0x10], 0xa043150
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xfa006b33
sub eax, 0xf9bfea33
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x364da
push 0
call eax
mov ecx, 0x400d
mov ebx, eax
mov edx, 0x3dacb6ab
add edx, 0xc29a2d55
add edx, dword [ebp - 0xc]
mov edi, 0xee82f618
sub dword [ebp - 8], 0x36d11572
mov esi, dword [edx]
sub dword [ebp - 8], eax
add esi, edi
xor dword [ebp - 4], eax
mov dword [ebx], esi
sub dword [ebp - 8], ecx
add ebx, 0x7f50ea05
sub ebx, 0x7f50ea01
add edx, 0xeb7d86f9
sub edx, 0xeb7d86f5
loop 0x401559
add eax, 0xf307
mov ebx, eax
add eax, 5
mov ecx, 0x75815289
sub ecx, 0x75415289
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x100826c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
mov ebx, dword [esp + 0x74]
lea eax, [esp + 0x20]
push ebp
push esi
push edi
push 0x34
push dword [esp + 0x7c]
mov edi, ebx
mov ebp, ebx
sub edi, dword [esp + 0x70]
sub ebp, dword [esp + 0x84]
push eax
mov dword [esp + 0x30], edi
call fcn.1007f014
xor esi, esi
add esp, 0xc
cmp dword [esp + 0x70], esi
jbe 0x1008280f
mov ecx, dword [esp + 0x6c]
mov edx, ebx
movzx eax, byte [ecx + esi*2]
mov dword [esp + 0x14], eax
movzx eax, byte [ecx + esi*2 + 1]
mov ecx, dword [esp + 0x68]
sub edx, eax
mov dword [esp + 0x28], eax
sub ecx, edx
mov dword [esp + 0x18], edx
mov eax, dword [esp + eax*4 + 0x2c]
mov dword [esp + 0x10], eax
xor eax, eax
inc eax
shl eax, cl
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x68]
sub eax, edx
mov dword [esp + 0x20], eax
cmp eax, ebp
jb 0x1008279b
xor eax, eax
add edx, edi
inc eax
cmp edx, eax
cmovl edx, eax
mov eax, dword [esp + 0x74]
mov ecx, dword [eax + edx*4]
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x74]
sub eax, ecx
push ebx
push eax
mov eax, dword [esp + 0x78]
lea eax, [eax + ecx*2]
mov ecx, dword [esp + 0x24]
push eax
imul eax, ecx, 0x34
push edx
add eax, dword [esp + 0x8c]
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x80]
push dword [esp + 0x3c]
lea eax, [ecx + eax*4]
push eax
call fcn.1007e3f0
mov edx, dword [esp + 0x40]
add esp, 0x24
jmp 0x100827fc
mov eax, dword [esp + 0x14]
movzx eax, ax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push 2
push eax
lea eax, [esp + 0x84]
push eax
call fcn.1007f014
mov ecx, dword [esp + 0x24]
xor eax, eax
mov edx, dword [esp + 0x28]
inc eax
mov byte [esp + 0x8a], cl
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x7f], al
lea eax, [edx + ecx]
cmp ecx, eax
jae 0x100827fc
mov ebx, dword [esp + 0x64]
mov ecx, edx
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x7c]
lea edi, [ebx + edi*4]
mov ebx, dword [esp + 0x80]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
add dword [esp + eax*4 + 0x2c], edx
inc esi
cmp esi, dword [esp + 0x70]
jb 0x10082701
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
Function at 0x10083390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
test ebx, ebx
je 0x100833e4
mov edi, dword [esp + 0x18]
test edi, 0xffff0000
jne 0x100833b5
sub edi, dword [ebx + esi + 0x10]
jmp 0x100833fc
mov eax, dword [ebx + esi + 0x20]
xor ebp, ebp
add eax, esi
mov dword [esp + 0x14], eax
cmp dword [ebx + esi + 0x18], ebp
jbe 0x100833e4
mov eax, dword [eax + ebp*4]
add eax, esi
push edi
push eax
call fcn.10087670
pop ecx
pop ecx
test eax, eax
je 0x100833ed
mov eax, dword [esp + 0x14]
inc ebp
cmp ebp, dword [ebx + esi + 0x18]
jb 0x100833c7
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 8
test ebp, ebp
js 0x100833e4
mov eax, dword [ebx + esi + 0x24]
lea eax, [eax + ebp*2]
movzx edi, word [eax + esi]
cmp edi, 0xffffffff
je 0x100833e4
cmp edi, dword [ebx + esi + 0x14]
jae 0x100833e4
mov eax, dword [ebx + esi + 0x1c]
lea eax, [eax + edi*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x100833e6
Function at 0x1009527c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x18]
call fcn.100843b0
shr eax, 8
pop ecx
test al, al
je 0x10095295
pop ebp
jmp fcn.1007cf38
pop ebp
jmp fcn.1008f81c
Function at 0x10098a88
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x1c]
mov ebx, dword [edx]
mov eax, dword [edx + 4]
test esi, esi
jle 0x10098aee
push ebp
mov ebp, dword [esp + 0x18]
sub ebp, dword [esp + 0x1c]
mov dword [esp + 0xc], esi
mov esi, dword [esp + 0x1c]
push edi
inc bl
movzx ebx, bl
mov cl, byte [edx + ebx + 8]
add al, cl
movzx eax, al
mov dword [esp + 0x18], eax
mov edi, dword [esp + 0x18]
mov al, byte [edx + eax + 8]
mov byte [edx + ebx + 8], al
add al, cl
movzx eax, al
mov byte [edx + edi + 8], cl
mov cl, byte [eax + edx + 8]
mov eax, edi
xor cl, byte [esi + ebp]
mov byte [esi], cl
inc esi
sub dword [esp + 0x10], 1
jne 0x10098aae
mov esi, dword [esp + 0x24]
pop edi
pop ebp
mov dword [edx + 4], eax
mov eax, esi
pop esi
mov dword [edx], ebx
pop ebx
pop ecx
ret

Function at 0x10098c14
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push ebx
push edi
mov ebx, 0x10091690
mov eax, dword [eax + 0xc]
push ebx
mov edi, dword [eax + 0x18]
push dword [edi + 0x28]
call fcn.10089a28
pop ecx
pop ecx
test eax, eax
jne 0x10098c3b
mov eax, dword [edi + 0x10]
jmp 0x10098c5a
push esi
mov esi, dword [edi + 4]
jmp 0x10098c53
push ebx
push dword [esi + 0x28]
call fcn.10089a28
pop ecx
pop ecx
test eax, eax
je 0x10098c5d
mov esi, dword [esi + 4]
cmp esi, edi
jne 0x10098c41
xor eax, eax
pop esi
pop edi
pop ebx
ret
mov eax, dword [esi + 0x10]
jmp 0x10098c59
Function at 0x29a05134
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x29a05143
pop dword [ebp - 0x14]
mov eax, 0x9c5a03af
sub eax, 0x72b9b26c
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x997b2b7a
sub dword [ebp - 0x24], 0x4b28e62f
mov dword [ebp - 0x20], 0xd0b40dfd
add dword [ebp - 0x20], 0x617f3e48
mov dword [ebp - 0x1c], 0x5a6ecc19
sub dword [ebp - 0x1c], 0xe2287eb
mov dword [ebp - 0x18], 0x22d1de82
add dword [ebp - 0x18], 0xdd2e217e
lea eax, [ebp - 0x24]
push eax
mov eax, 0xf629903f
add eax, 0x3377b04d
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xc460c5c9
sub dword [ebp - 0x24], 0x4fee5c73
mov dword [ebp - 0x20], 0x9089fa48
sub dword [ebp - 0x20], 0x4f1d98d3
mov dword [ebp - 0x1c], 0xe85af760
add dword [ebp - 0x1c], 0x7b14750c
mov dword [ebp - 0x18], 0x8e106b27
sub dword [ebp - 0x18], 0x8e106b27
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x60263e6c
sub eax, 0x3684fe28
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x39ce8
push 0
call eax
mov ecx, 0x4faf28c0
add ecx, 0xb0511d52
mov esi, eax
mov edx, 0x29a22000
add edx, dword [ebp - 0x14]
mov ebx, 0xca25a96b
add ebx, 0xbac2d5ab
xor dword [ebp - 0xc], ebx
mov edi, dword [edx]
xor dword [ebp - 0x10], esi
add edi, ebx
xor dword [ebp - 0xc], eax
mov dword [esi], edi
mov dword [ebp - 4], 0xfbf4de9
add esi, 0x34187562
add esi, 0xcbe78aa2
add edx, 0x3819cd1f
add edx, 0xc7e632e5
loop 0x29a0525f
add eax, 0x5898a1ab
add eax, 0xa7686970
mov ebx, eax
add eax, 0xa0dd9951
sub eax, 0xa0dd994c
mov ecx, 0x33180c8f
add ecx, 0xf687f371
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1001e930
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x1001e962
jl 0x1001e955
test ecx, ecx
jne 0x1001e962
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1001ea22
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.1001fb10
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1001e9ce
jg 0x1001e98d
test esi, esi
je 0x1001e9ce
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x1001e9a5
mov eax, dword [esp + 0x10]
jl 0x1001e99f
cmp eax, esi
jae 0x1001e9a5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.10081990
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x1001e9ef
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x1001ea0b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x1001e974
jl 0x1001ea0b
test ecx, ecx
jne 0x1001e974
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov esi, dword [ebp + 0x10]
sbb esi, edx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x1001ea60
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x1001ea60
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [esp + 0x14]
call fcn.10081990
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [esp + 0x18], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x1001eac9
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1001ea86
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x1001eab4
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.10089ac8
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x1001eac9
cmp edi, eax
ja 0x1001ea92
test edi, edi
je 0x1001eac9
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.10089ac8
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100208e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a7bb0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10102040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.1007c9c1
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1007df02
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.1001fd30
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10031600
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a87c5
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x10102040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], ecx
push 9
push str._Unknown_
mov dword [ebp - 4], 0
call fcn.10031c90
cmp dword [ebp + 0x1c], 7
lea ecx, [ebp - 0x24]
lea eax, [ebp + 8]
cmova eax, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
jne 0x10031664
mov byte [ebp - 0x29], al
jmp 0x100317ed
mov dword [ebp - 0x14], 0
xorps xmm0, xmm0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
cmp edi, 0x7fffffff
ja 0x10031813
push edi
lea ecx, [ebp - 0x1c]
call fcn.10019e60
mov eax, dword [ebp - 0x1c]
push edi
push 0
push eax
lea esi, [eax + edi]
call fcn.100817d0
add esp, 0xc
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
call fcn.10019d70
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
push dword [ebp - 0x1c]
cmp dword [ebp + 0x1c], 7
push edi
cmova eax, dword [ebp + 8]
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x100316e9
mov byte [ebp - 0x29], al
jmp 0x100317a8
lea eax, [ebp - 0x20]
mov dword [ebp - 0x28], 0
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x20], 0
push eax
push 0x100d82b8
push dword [ebp - 0x1c]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x100317a4
cmp dword [ebp - 0x20], 0
je 0x100317a4
mov edx, dword [ebp - 0x28]
cmp dword [edx], 0xfeef04bd
jne 0x100317a4
mov ecx, dword [edx + 0xc]
movzx eax, cx
shr ecx, 0x10
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], ecx
mov ecx, dword [edx + 8]
lea edx, [ebp - 0x34]
movzx eax, cx
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
shr ecx, 0x10
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x34], ecx
push eax
push 0x14
push str.Version:_...
lea ecx, [ebp - 0x58]
call fcn.10032640
mov edi, dword [ebp - 0x40]
mov esi, eax
add esp, 0x14
cmp edi, esi
je 0x1003179c
mov ecx, edi
call fcn.1001f760
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x58]
call fcn.1001f760
mov byte [ebp - 0x29], 1
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x100317ed
mov edx, dword [ebp - 0x14]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x100317ce
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10031818
push edx
push ecx
call fcn.1007cee4
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp + 8]
call fcn.1001f760
mov al, byte [ebp - 0x29]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007c8d3
mov esp, ebp
pop ebp
ret
call fcn.100185e0
call fcn.100852de
int3