joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10031730
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006da21
mov eax, dword fs:[0]
push eax
mov eax, 0x2044
call fcn.1004f4c0
mov eax, dword [0x1008b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2030], 0
lea ecx, [ebp - 0x2050]
call fcn.10007bd0
mov dword [ebp - 4], 0
push 0
push 8
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x2044]
call fcn.1002efd0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2044]
call fcn.1002f090
movzx edx, al
test edx, edx
je 0x10031883
mov dword [ebp - 0x202c], 0
xor eax, eax
mov word [ebp - 0x2010], ax
push 0x1ffe
push 0
lea ecx, [ebp - 0x200e]
push ecx
call fcn.10051430
add esp, 0xc
mov edx, 1
test edx, edx
je 0x10031883
mov dword [ebp - 0x2034], 0x1000
mov eax, dword [ebp - 0x202c]
mov dword [ebp - 0x2038], eax
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2034]
push ecx
lea edx, [ebp - 0x2010]
push edx
mov eax, dword [ebp - 0x2038]
push eax
lea ecx, [ebp - 0x2044]
call fcn.10015980
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x203c], eax
mov ecx, dword [ebp - 0x202c]
add ecx, 1
mov dword [ebp - 0x202c], ecx
cmp dword [ebp - 0x203c], 0
je 0x10031847
jmp 0x10031883
lea edx, [ebp - 0x2010]
push edx
lea ecx, [ebp - 0x2028]
call fcn.10004e40
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2028]
push eax
lea ecx, [ebp - 0x2050]
call fcn.10014170
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2028]
call fcn.10004d70
jmp 0x100317d5
lea ecx, [ebp - 0x2050]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10007b60
mov edx, dword [ebp - 0x2030]
or edx, 1
mov dword [ebp - 0x2030], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2044]
call fcn.1002f060
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2050]
call fcn.10007680
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004e421
mov esp, ebp
pop ebp
ret
Function at 0x100318e0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006da58
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1008b06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 0
je 0x10031911
cmp dword [ebp + 0x10], 0
jne 0x10031916
jmp 0x100319c4
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.10031580
add esp, 0xc
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.100074d0
cmp eax, dword [ebp + 0x10]
jle 0x100319b5
lea ecx, [ebp - 0x28]
call fcn.100074d0
sub eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push 0x100330f0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x28]
call fcn.10007560
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x28]
call fcn.10007620
mov eax, dword [eax]
push eax
call fcn.100331a0
add esp, 0xc
mov dword [ebp - 0x10], 0
jmp 0x10031989
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x14]
jge 0x100319b5
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
call fcn.100074b0
mov ecx, eax
call fcn.10004d30
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x10031980
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10007680
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x100319e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006da8b
mov eax, dword fs:[0]
push eax
mov eax, 0x10028
call fcn.1004f4c0
mov eax, dword [0x1008b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 0
je 0x10031a1b
cmp dword [ebp + 0x10], 0
jne 0x10031a20
jmp 0x10031b31
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x10028]
push edx
call fcn.10031580
add esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1002c]
push eax
lea ecx, [ebp - 0x10028]
call fcn.10007620
mov ecx, dword [eax]
mov dword [ebp - 0x10014], ecx
jmp 0x10031a6e
push 0
lea edx, [ebp - 0x10030]
push edx
lea ecx, [ebp - 0x10014]
call fcn.10014140
lea eax, [ebp - 0x10034]
push eax
lea ecx, [ebp - 0x10028]
call fcn.10007560
push eax
lea ecx, [ebp - 0x10014]
call fcn.10007470
movzx ecx, al
test ecx, ecx
je 0x10031b1f
mov dword [ebp - 0x1001c], 0
mov dword [ebp - 0x10018], 0x10000
lea edx, [ebp - 0x10018]
push edx
lea eax, [ebp - 0x10010]
push eax
lea ecx, [ebp - 0x1001c]
push ecx
lea ecx, [ebp - 0x10014]
call fcn.1000be20
mov ecx, eax
call fcn.10004d30
push eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10031b1a
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x10018]
push edx
lea eax, [ebp - 0x10010]
push eax
mov ecx, dword [ebp - 0x1001c]
push ecx
lea ecx, [ebp - 0x10014]
call fcn.1000be20
mov ecx, eax
call fcn.10004d30
push eax
call dword [ebp + 0x10]
test eax, eax
jne 0x10031b1a
jmp 0x10031b1f
jmp 0x10031a5a
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10028]
call fcn.10007680
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004e421
mov esp, ebp
pop ebp
ret

Function at 0x10031cd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1008b06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], 0
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x10031d64
xor edx, edx
mov word [ebp - 0x20c], dx
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call fcn.10051430
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x10031d64
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [ebp - 0x214], 1
cmp dword [ebp - 0x210], 0
je 0x10031d7a
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e421
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10035ad0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006dceb
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x1008b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.10051430
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
lea eax, [ebp - 0x248]
push eax
call fcn.1002ffa0
add esp, 8
mov dword [ebp - 0x24c], eax
mov ecx, dword [ebp - 0x24c]
mov dword [ebp - 0x250], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x10]
call fcn.10004ef0
push eax
mov ecx, dword [ebp - 0x250]
call fcn.10004d30
push eax
push str.hestia_s._hs
lea edx, [ebp - 0x230]
push edx
call fcn.10031000
add esp, 0x10
mov dword [ebp - 0x254], eax
mov ecx, dword [ebp - 0x254]
call fcn.10004d30
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x230]
call fcn.10004d70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.10004d70
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.1002f340
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x218]
push eax
push str.save_html__s__length:_d
call fcn.10035990
add esp, 0xc
mov ecx, dword [ebp + 0xc]
shl ecx, 1
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x218]
push eax
call fcn.1002f6d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004e421
mov esp, ebp
pop ebp
ret
Function at 0x10036640
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006de04
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x1008b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x74], 0
push 0x10080c6c
lea ecx, [ebp - 0x40]
call fcn.10005000
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x74]
or eax, 1
mov dword [ebp - 0x74], eax
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x70]
push edx
call fcn.10035960
add esp, 8
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x84], eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x74]
or ecx, 2
mov dword [ebp - 0x74], ecx
mov ecx, dword [ebp - 0x84]
call fcn.10004ef0
push eax
lea ecx, [ebp - 0x28]
call fcn.10005000
mov dword [ebp - 4], 2
mov edx, dword [ebp - 0x74]
or edx, 4
mov dword [ebp - 0x74], edx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x58]
push ecx
call fcn.10003ae0
add esp, 8
mov dword [ebp - 0x88], eax
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x8c], edx
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x74]
or eax, 8
mov dword [ebp - 0x74], eax
push 0
mov ecx, dword [ebp - 0x8c]
call fcn.10004d30
push eax
push 0x1008ddb8
call fcn.10030f30
test eax, eax
je 0x10036741
movzx ecx, byte [0x1008dd90]
test ecx, ecx
jne 0x10036741
mov dword [ebp - 0x7c], 1
jmp 0x10036748
mov dword [ebp - 0x7c], 0
mov dl, byte [ebp - 0x7c]
mov byte [ebp - 0x75], dl
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x74]
and eax, 8
je 0x10036769
and dword [ebp - 0x74], 0xfffffff7
lea ecx, [ebp - 0x58]
call fcn.10004d70
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x74]
and ecx, 4
je 0x10036784
and dword [ebp - 0x74], 0xfffffffb
lea ecx, [ebp - 0x28]
call fcn.10004f30
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x74]
and edx, 2
je 0x1003679f
and dword [ebp - 0x74], 0xfffffffd
lea ecx, [ebp - 0x70]
call fcn.10004f30
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x74]
and eax, 1
je 0x100367ba
and dword [ebp - 0x74], 0xfffffffe
lea ecx, [ebp - 0x40]
call fcn.10004f30
movzx ecx, byte [ebp - 0x75]
test ecx, ecx
je 0x100367de
push 0
push 0
push 0
push 0x100362e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004e421
mov esp, ebp
pop ebp
ret

Function at 0x10036ea0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.1004f4c0
mov eax, dword [0x1008b06c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1008dfc4], 0
je 0x10036ec4
xor al, al
jmp 0x10036f0f
push str._DtDebug_start_message_loop
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.hestia
push 0x42
push str.main.cpp
push str._s._d:_s
push 0x800
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x18
lea ecx, [ebp - 0x1004]
push ecx
push 0
push 0x10036e40
call fcn.10012890
mov dword [0x1008dfc4], eax
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e421
mov esp, ebp
pop ebp
ret
Function at 0x100370c0
Capabilities:
Check if file exists
Move file
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x1008b06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x42c], str.pandora32.dll
mov dword [ebp - 0x428], str.hestia32.dll
mov dword [ebp - 0x424], str.siriux32.dll
mov dword [ebp - 0x420], str.siriux64.dll
mov dword [ebp - 0x41c], str.siriuw32.dll
mov dword [ebp - 0x418], str.siriuw64.dll
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0
jmp 0x10037134
mov eax, dword [ebp - 0x430]
add eax, 1
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 6
jae 0x10037203
xor ecx, ecx
mov word [ebp - 0x20c], cx
push 0x206
push 0
lea edx, [ebp - 0x20a]
push edx
call fcn.10051430
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x430]
mov edx, dword [ebp + ecx*4 - 0x42c]
push edx
mov eax, dword [0x1008ddb0]
push eax
call fcn.1002f5e0
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100371fe
xor edx, edx
mov word [ebp - 0x414], dx
push 0x206
push 0
lea eax, [ebp - 0x412]
push eax
call fcn.10051430
add esp, 0xc
call fcn.1002fa00
push eax
lea ecx, [ebp - 0x20c]
push ecx
push str._s._08x.dirty
push 0x104
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x100371fe
mov dword [ebp - 0x434], 1
jmp 0x10037125
cmp dword [ebp - 0x434], 0
je 0x1003721f
push str._DtDebug_old_module_set_be_dirty
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e421
mov esp, ebp
pop ebp
ret

Function at 0x10037230
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006dc58
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1008b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x10081014
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.10029f60
add esp, 0xc
mov dword [ebp - 4], 0
push 0
push str.3239
lea ecx, [ebp - 0x28]
call fcn.10031e70
cmp eax, dword [0x100828c0]
je 0x1003728d
jmp 0x100372cf
push 0
push str.4280
lea ecx, [ebp - 0x28]
call fcn.10031e70
cmp eax, dword [0x100828c0]
je 0x100372a6
jmp 0x100372cf
push 0
push str.4472
lea ecx, [ebp - 0x28]
call fcn.10031e70
cmp eax, dword [0x100828c0]
je 0x100372c4
call fcn.10036640
jmp 0x100372cf
push str._DtDebug_unsupported_cef_version
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004d70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004e421
mov esp, ebp
pop ebp
ret
Function at 0x10037300
Capabilities:
Check if file exists
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1008b06c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.10051430
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10037366
push str._DtDebug_module_fceder_not_found
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x10037375
lea edx, [ebp - 0x20c]
push edx
call fcn.10037230
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e421
mov esp, ebp
pop ebp
ret

Function at 0x10037390
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov byte [ebp - 1], al
push 0
push 0
push 0
lea ecx, [ebp - 1]
call fcn.10037490
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1008dfc0], eax
mov esp, ebp
pop ebp
ret

Function at 0x100373c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
jmp 0x100373db
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc8
jge 0x10037425
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.libcef.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10037423
push str._DtDebug_fceder_loaded_delay_check________
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [0x1008ddb4], 1
mov ecx, dword [ebp - 8]
push ecx
call fcn.10037300
add esp, 4
jmp 0x10037425
jmp 0x100373d2
cmp dword [0x1008ddb4], 0
jne 0x10037439
push str._DtDebug_fceder_not_loaded_delay_check________
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x1008dfc0], 0
je 0x10037459
mov edx, dword [0x1008dfc0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1008dfc0], 0
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x100374a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006d938
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1008b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x10081110
lea eax, [ebp - 0x28]
push eax
call fcn.10031000
add esp, 0xc
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10004d30
push eax
call fcn.1002fb50
test eax, eax
je 0x10037515
push str._DtDebug_only_works_on_first_loaded
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004d70
jmp 0x10037576
lea ecx, [ebp - 0x28]
call fcn.10004d30
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x100811e8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x10037557
push str._DtDebug_fceder_found
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.10037300
add esp, 4
jmp 0x10037567
push str._DtDebug_fceder_not_found__will_catch_it
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.10037390
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004d70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004e421
mov esp, ebp
pop ebp
ret

Function at 0x10037590
Capabilities:
Print debug messages
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1008b06c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 1
jne 0x10037667
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.10051430
add esp, 0xc
mov edx, dword [ebp + 8]
mov dword [0x1008ddb0], edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x104
push 0x1008ddb8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x1008ddb8
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0x210], eax
call fcn.100128e0
cmp eax, 2
jne 0x10037637
call fcn.100370c0
push 0x10036f80
mov eax, dword [ebp + 8]
push eax
call fcn.100121a0
jmp 0x10037665
cmp dword [ebp - 0x210], 0
je 0x10037665
call fcn.10036cc0
test eax, eax
je 0x10037665
call fcn.10036cc0
push eax
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10037665
call fcn.100374a0
jmp 0x1003769a
cmp dword [ebp + 0xc], 0
jne 0x1003769a
cmp dword [0x1008dfc0], 0
je 0x1003769a
push str._DtDebug_terminate_delayhk_routine
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 1
mov edx, dword [0x1008dfc0]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x1008dfc0], 0
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e421
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1003ac40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x1008e08c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.10037f30
push 0
push 0
push 0
push 0x1003ab70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x10045260
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [0x1008bed0]
test eax, eax
je 0x1004529c
mov byte [0x1008bed0], 0
push 0x1008e0a4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
push 0x10045120
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x60
push 0x110eb60
call fcn.0040121c
mov edi, 0x94
mov eax, edi
call fcn.004011dc
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x110eb60], ecx
mov eax, dword [esi + 4]
mov dword [0x110eb64], eax
mov edx, dword [esi + 8]
mov dword [0x110eb68], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x110eb6c], esi
cmp ecx, 2
je 0x401060
or esi, 0x8000
mov dword [0x110eb70], esi
shl eax, 8
add eax, edx
mov dword [0x110eb60], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40109b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40109b
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4010b3
cmp eax, 0x20b
je 0x4010a0
mov dword [ebp - 0x1c], esi
jmp 0x4010c7
cmp dword [ecx + 0x84], 0xe
jbe 0x40109b
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4010c1
cmp dword [ecx + 0x74], 0xe
jbe 0x40109b
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00401224
pop ecx
test eax, eax
jne 0x4010f3
cmp dword [0x110eb60], 1
jne 0x4010e0
call fcn.00401224
push 0x1c
call fcn.00401224
push 0xff
call fcn.00401224
pop ecx
pop ecx
call fcn.00401224
mov dword [ebp - 4], esi
call fcn.00401224
test eax, eax
jge 0x40110c
push 0x1b
call fcn.00401224
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x110eb60], eax
call fcn.00401224
mov dword [0x110eb64], eax
call fcn.00401224
test eax, eax
jge 0x401132
push 8
call fcn.00401224
pop ecx
call fcn.00401224
test eax, eax
jge 0x401143
push 9
call fcn.00401224
pop ecx
push 1
call fcn.00401224
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x401159
push eax
call fcn.00401224
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00401224
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x40117a
movzx eax, word [ebp - 0x40]
jmp 0x40117d
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00401228
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x40119b
push edi
call fcn.00401220
call fcn.00401224
jmp 0x4011cd
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00401224
ret

Function at 0x401228
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
push edi
push ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 0x485000
push section..rdata
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401252
push 0xc8a1e0
jmp 0x40125e
pop ebx
pop edi
pop esi
leave
ret 0x14
ret