joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003f410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x84
mov eax, dword [0x1039f328]
movsd xmm0, qword [0x1039f318]
movsd xmm1, qword [0x1039f320]
mov ebp, edx
mov edx, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x34]
movsd qword [esp + 0x34], xmm0
movsd qword [esp + 0x3c], xmm1
push eax
call fcn.1003f5b0
add esp, 4
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x10], 1
jne 0x1003f540
mov al, byte [esp + 0x32]
mov edi, dword [esp + 0x2c]
movzx ebx, word [esp + 0x30]
lea ecx, [esp + 0x48]
mov edx, ebp
mov byte [esp + 3], al
push dword [esp + 0x98]
call fcn.10036460
add esp, 4
mov eax, dword [esi + 0x28]
movsd xmm0, qword [esp + 0x18]
movsd xmm1, qword [esp + 0x20]
mov ebp, esi
lea esi, [esp + 0x5c]
mov edx, ebx
mov ecx, ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
movsd qword [esp + 0x64], xmm1
movsd qword [esp + 0x5c], xmm0
movsd xmm0, qword [esp + 0x48]
movsd xmm1, qword [esp + 0x50]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x58]
movsd qword [esp + 0x78], xmm1
movsd qword [esp + 0x70], xmm0
mov dword [esp + 0x80], eax
lea eax, [esp + 0x70]
push eax
push esi
call fcn.1003f830
add esp, 8
mov eax, dword [esp + 4]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x1c]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0
mov esi, eax
nop word cs:[eax + eax]
nop dword [eax]
mov ebp, edi
cmp edi, edx
mov edi, 0
jae 0x1003f510
cmp word [ecx + ebp*4], 0xffff
je 0x1003f552
mov edi, dword [ecx + ebp*4]
inc dword [esp + 8]
movzx eax, si
shl ebx, 0x10
or eax, ebx
mov dword [ecx + ebp*4], eax
inc ebp
mov esi, edi
shr edi, 0x10
mov ebx, edi
mov edi, ebp
jmp 0x1003f510
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 0x28]
cmp edx, ecx
ja 0x1003f58f
push 0x10399010
jmp 0x1003f59f
mov word [ecx + ebp*4], si
mov word [ecx + ebp*4 + 2], bx
cmp byte [esp + 3], 0
mov ecx, dword [esp + 0xc]
jne 0x1003f570
cmp dword [esp + 8], 0x80
jb 0x1003f584
mov eax, dword [ecx]
or eax, dword [ecx + 4]
jne 0x1003f584
mov dword [ecx + 4], 0
mov dword [ecx], 1
mov edx, dword [ecx + 0x28]
mov ecx, dword [esp + 4]
cmp edx, ecx
jbe 0x1003f59a
add esp, 0x84
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x103985a8
call fcn.10008590
add esp, 4
ud2
Function at 0x10042210
Capabilities:
Check for software breakpoints
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xdd8
call fcn.10042224
Function at 0x1004b2b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
cmp dword [edx], 1
mov ebp, edx
mov edi, ecx
jne 0x1004b2d6
push dword [ebp + 4]
call sub.CRYPT32.dll_CertDuplicateCertificateContext
mov esi, 1
mov dword [esp], 0
jmp 0x1004b2dd
mov al, 1
xor esi, esi
mov dword [esp], eax
mov dword [esp + 0x18], eax
push 0
push 0
push 0
push 0
push 2
call sub.CRYPT32.dll_CertOpenStore
test eax, eax
je 0x1004b36d
mov dword [esp + 0x10], edi
mov edi, dword [ebp + 0x10]
mov ebx, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], ebp
test edi, edi
je 0x1004b349
mov eax, dword [esp + 0x14]
shl edi, 2
lea ebp, [esp + 0x1c]
mov esi, dword [eax + 8]
nop
mov dword [esp + 0x1c], 0
push ebp
push 3
push dword [esi]
push ebx
call sub.CRYPT32.dll_CertAddCertificateContextToStore
cmp eax, 1
jne 0x1004b378
add esi, 4
push dword [esp + 0x1c]
call sub.CRYPT32.dll_CertFreeCertificateContext
add edi, 0xfffffffc
jne 0x1004b320
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
mov dword [esp], 0
mov ch, byte [esi + 0x14]
mov ah, byte [esi + 0x15]
mov dl, byte [esi + 0x18]
mov cl, byte [esi + 0x17]
mov al, byte [esi + 0x16]
jmp 0x1004b3b8
xor ebx, ebx
call sub.KERNEL32.dll_GetLastError
mov ebp, eax
jmp 0x1004b38b
call sub.KERNEL32.dll_GetLastError
mov ebp, eax
push 0
push ebx
call sub.CRYPT32.dll_CertCloseStore
mov edi, dword [esp + 0x10]
mov eax, dword [esp]
test al, al
je 0x1004b3a1
mov cl, 1
mov dword [esp + 0xc], 0
mov dword [esp], ecx
jmp 0x1004b3b8
mov dword [esp + 0xc], 0
push dword [esp + 0x18]
mov al, 1
mov dword [esp + 4], eax
call sub.CRYPT32.dll_CertFreeCertificateContext
mov dh, byte [esp + 0x23]
movzx esi, word [esp + 0x21]
cmp byte [esp], 0
mov byte [esp + 0xa], dh
mov word [esp + 8], si
je 0x1004b3e1
mov eax, dword [esp + 0xc]
mov dword [edi + 8], ebp
mov dword [edi + 4], eax
mov eax, 1
jmp 0x1004b421
movzx esi, word [esp + 8]
mov dword [edi + 8], ebp
mov ebp, dword [esp + 0xc]
mov dh, byte [esp + 0xa]
mov word [esp + 4], si
mov dword [edi + 4], ebp
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], ch
mov byte [edi + 0x11], ah
mov byte [edi + 0x12], dl
mov byte [edi + 0x13], cl
mov byte [edi + 0x14], al
mov byte [esp + 6], dh
movzx eax, word [esp + 4]
mov word [edi + 0x15], ax
mov al, byte [esp + 6]
mov byte [edi + 0x17], al
xor eax, eax
mov dword [edi], eax
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1004b9c0
Capabilities:
Generate random numbers via rtlgenrandom
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xffffffe0
sub esp, 0xa0
mov eax, dword [0x104118f8]
test eax, eax
jne 0x1004b9e1
mov ecx, 0x104118f8
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x1004b9fc
mov esi, eax
mov eax, dword [eax]
xor eax, 1
or eax, dword [esi + 4]
je 0x1004bbd3
mov eax, dword [0x104118f8]
test eax, eax
jne 0x1004ba0f
mov ecx, 0x104118f8
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x1004ba41
mov esi, eax
cmp eax, 1
jne 0x1004ba8e
mov eax, esp
mov ecx, 0x103c9a77
mov edx, 0x46
push 0x103c9ac0
push 0x10397ad0
push eax
call fcn.1000aa20
add esp, 0xc
ud2
call sub.KERNEL32.dll_GetProcessHeap
push 0x160
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x1004bbee
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x158], 0x104118f8
mov esi, eax
mov eax, dword [0x104118f8]
test eax, eax
jne 0x1004ba87
mov ecx, 0x104118f8
call fcn.100f2930
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
xorps xmm0, xmm0
mov ecx, 0x20
mov eax, esp
xor edx, edx
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
nop word cs:[eax + eax]
nop dword [eax]
test dl, 1
jne 0x1004baf1
lea edi, [eax + ecx]
push ecx
push eax
call sub.ADVAPI32.dll_SystemFunction036
xor ecx, ecx
test al, al
mov dl, 1
mov eax, edi
jne 0x1004bab0
call sub.KERNEL32.dll_GetProcessHeap
push 4
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
jne 0x1004bbdf
mov ecx, 4
mov edx, 4
call fcn.100067d0
ud2
movaps xmm0, xmmword [esp]
movaps xmm1, xmmword [esp + 0x10]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0x40
lea eax, [esi + 0x20]
movaps xmmword [esp + 0x10], xmm0
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm1
movaps xmm2, xmmword [esp + 0x10]
movaps xmmword [esp + 0x30], xmm0
movaps xmm1, xmmword [esp]
movaps xmm3, xmmword [esp + 0x20]
movaps xmmword [esp + 0x60], xmm2
movaps xmm2, xmmword [esp + 0x30]
movups xmmword [esi + 0x10], xmm0
movaps xmm0, xmmword [0x10364fb0]
movaps xmmword [esp + 0x80], xmm1
movaps xmmword [esp + 0x70], xmm3
movaps xmmword [esp + 0x50], xmm2
movups xmmword [esi], xmm0
push 0xe0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
movaps xmm1, xmmword [esp + 0x80]
movaps xmm0, xmmword [esp + 0x60]
movaps xmm2, xmmword [esp + 0x50]
movups xmmword [esi + 0x100], xmm1
movaps xmm1, xmmword [esp + 0x70]
movups xmmword [esi + 0x110], xmm0
movups xmmword [esi + 0x130], xmm2
movups xmmword [esi + 0x120], xmm1
mov dword [esi + 0x144], 0
mov dword [esi + 0x140], 0x10000
mov dword [esi + 0x14c], 0
mov dword [esi + 0x148], 0x10000
mov dword [esi + 0x150], 0
add esi, 8
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov ecx, eax
mov dword [eax], reloc.XINPUT1_3.dll_Ordinal_4
call fcn.1004bc00
ud2
mov ecx, 0x160
mov edx, 8
call fcn.100067d0
ud2
Function at 0x10051fe0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, edx
mov edx, dword [esp + 0x3c]
mov dword [esp], ecx
lea ecx, [esp + 0x1c]
push 0xb
call fcn.10051d00
add esp, 4
mov dword [esp + 4], 0x800
mov dword [esp + 0xc], 0
call sub.KERNEL32.dll_GetProcessHeap
push 0x800
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10052121
mov esi, dword [ebx]
mov ecx, dword [esp + 0x1c]
mov edi, eax
lea ebp, [esp + 0xc]
lea ebx, [esp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x800
mov dword [esp + 0x18], 0
mov dword [esp + 8], ecx
lea eax, [esp + 4]
push eax
push edi
push ebp
push 0
push dword [esp + 0x18]
push esi
call sub.ADVAPI32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x1005207b
mov edx, dword [esp + 4]
mov ecx, ebx
call fcn.10116f60
mov edi, dword [esp + 0x10]
jmp 0x10052050
test eax, eax
jne 0x100520b0
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
cmp eax, 0xb
jbe 0x100520da
mov eax, dword [esp]
mov dword [eax + 8], 0xde
mov dword [eax + 4], 0
mov dword [eax], 1
cmp dword [esp + 0x14], 0
jne 0x100520ca
jmp 0x100520f8
mov ecx, dword [esp]
mov dword [ecx + 8], eax
mov dword [ecx + 4], 0
mov dword [ecx], 1
cmp dword [esp + 0x14], 0
je 0x100520f8
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
jmp 0x100520f8
mov ecx, dword [esp + 0x18]
mov edx, dword [esp]
movsd xmm0, qword [esp + 0x10]
mov dword [edx + 0xc], ecx
movsd qword [edx + 4], xmm0
mov byte [edx + 0x10], al
mov dword [edx], 0
mov eax, bind
or eax, dword [esp + 0x20]
cmp eax, 0x80000000
je 0x10052119
call sub.KERNEL32.dll_GetProcessHeap
push dword [esp + 8]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x800
mov edx, 1
call fcn.100067d0
ud2
Function at 0x10053280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [edx], 1
mov ebp, edx
jne 0x100532ae
mov esi, dword [ebp + 0x30]
cmp dword [ebp + 0x24], 0xffffffff
mov edi, dword [ebp + 0x34]
mov ebx, dword [ebp + 0x38]
mov eax, dword [ebp + 0x3c]
lea edx, [ebp + 8]
je 0x100533f6
push 0
jmp 0x100533f8
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp + 0x30]
mov esi, dword [ebp + 0x34]
mov bl, byte [ebp + 0xc]
mov edi, dword [ebp + 4]
mov dword [esp + 0x14], ebp
lea edx, [ecx + esi]
mov dword [esp + 8], ecx
mov dword [esp + 0x10], esi
mov dword [esp + 4], edx
jmp 0x100532e9
mov ebp, dword [esp + 0x14]
add edi, ecx
mov dword [ebp + 4], edi
mov eax, ebx
xor bl, 1
test edi, edi
mov byte [ebp + 0xc], bl
je 0x1005330d
cmp esi, edi
je 0x1005330d
jbe 0x10053430
mov ecx, dword [esp + 8]
cmp byte [ecx + edi], 0xbf
jle 0x10053430
cmp esi, edi
je 0x10053406
mov ecx, dword [esp + 8]
mov byte [esp + 3], al
mov eax, esi
lea esi, [ecx + edi]
mov bh, byte [esi]
movzx ebp, bh
test bh, bh
jns 0x100533b0
mov edx, dword [esp + 4]
lea ecx, [esi + 1]
cmp ecx, edx
je 0x10053346
movzx ecx, byte [esi + 1]
add esi, 2
and ecx, 0x3f
jmp 0x1005334a
xor ecx, ecx
mov esi, edx
and ebp, 0x1f
cmp bh, 0xdf
jbe 0x10053363
mov edx, dword [esp + 4]
cmp esi, edx
je 0x1005336a
movzx eax, byte [esi]
inc esi
and eax, 0x3f
jmp 0x1005336e
shl ebp, 6
or ebp, ecx
jmp 0x100533b0
xor eax, eax
mov esi, edx
shl ecx, 6
or ecx, eax
cmp bh, 0xf0
jb 0x1005338a
cmp esi, dword [esp + 4]
mov eax, dword [esp + 0x10]
je 0x10053395
movzx esi, byte [esi]
and esi, 0x3f
jmp 0x10053397
mov eax, dword [esp + 0x10]
shl ebp, 0xc
or ebp, ecx
jmp 0x100533b0
xor esi, esi
and ebp, 7
shl ecx, 6
shl ebp, 0x12
or ecx, ebp
or ecx, esi
mov ebp, ecx
nop word cs:[eax + eax]
cmp byte [esp + 3], 0
jne 0x10053416
cmp ebp, 0x110000
je 0x1005340a
mov esi, eax
mov ecx, 1
cmp ebp, 0x80
jb 0x100532e0
mov ecx, 2
cmp ebp, 0x800
jb 0x100532e0
cmp ebp, 0x10000
mov ecx, 4
sbb ecx, 0
jmp 0x100532e0
push 1
push eax
push ebx
push edi
push esi
call fcn.100535b0
add esp, 0x2c
jmp 0x1005342b
test al, al
jne 0x10053418
mov eax, dword [esp + 0xc]
mov dword [eax], 0
jmp 0x10053428
mov esi, edi
mov eax, dword [esp + 0xc]
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax], 1
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esp + 8]
mov edx, esi
push 0x103c9e10
push esi
push edi
call fcn.10009090
add esp, 0xc
ud2
Function at 0x1005eff0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [ecx]
mov esi, ecx
test eax, eax
je 0x1005f068
cmp eax, 1
jne 0x1005f1d2
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
or ecx, dword [esi + 0xc]
je 0x1005f098
lea ecx, [esi + 0x18]
or eax, edx
je 0x1005f15e
mov eax, dword [ecx]
xor eax, 4
or eax, dword [ecx + 4]
je 0x1005f1d2
call fcn.1005fa90
lea ecx, [esi + 0xf0]
call fcn.1005fbd0
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x1005f1d2
lock dec dword [eax]
jne 0x1005f1d2
add esi, 0x12c
mov ecx, esi
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.10116ed0
mov eax, dword [esi + 0x128]
xor eax, 3
or eax, dword [esi + 0x12c]
je 0x1005f1d2
lea edi, [esi + 0x128]
add esi, 8
mov ecx, esi
call fcn.1005f1e0
mov ecx, edi
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.1005f290
mov ecx, eax
xor ecx, 2
or ecx, edx
je 0x1005f1d2
lea edi, [esi + 0x18]
or eax, edx
je 0x1005f167
cmp byte [edi], 0
je 0x1005f186
cmp byte [esi + 0x60], 0xa
lea ebx, [esi + 0x20]
jb 0x1005f0d9
cmp dword [esi + 0x68], 0
je 0x1005f0d9
mov ebp, dword [ebx + 0x44]
call sub.KERNEL32.dll_GetProcessHeap
push ebp
push 0
push eax
call sub.KERNEL32.dll_HeapFree
cmp byte [ebx + 0x54], 2
jb 0x1005f105
mov eax, dword [esi + 0x78]
mov ecx, dword [eax + 0xc]
lea edx, [eax + 8]
push dword [eax + 4]
push dword [eax]
push edx
call dword [ecx + 4]
add esp, 0xc
mov ebp, dword [esi + 0x78]
call sub.KERNEL32.dll_GetProcessHeap
push ebp
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x88]
lea ecx, [ebx + 0x64]
push dword [esi + 0x80]
push dword [esi + 0x7c]
push ecx
call dword [eax + 4]
add esp, 0xc
mov eax, dword [esi + 0x98]
lea ecx, [ebx + 0x74]
push dword [esi + 0x90]
push dword [esi + 0x8c]
push ecx
call dword [eax + 4]
add esp, 0xc
push ebx
call fcn.1004fdd0
add esp, 4
lea ecx, [esi + 0xa0]
call fcn.100570c0
lea ecx, [esi + 0xa8]
call fcn.100547a0
mov esi, dword [esi + 0x1c]
jmp 0x1005f189
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.1005fa90
push edi
call fcn.1004fdd0
add esp, 4
lea ecx, [esi + 0x58]
call fcn.100570c0
add esi, 0x60
mov ecx, esi
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.1005f350
mov esi, dword [edi + 4]
mov eax, dword [esi]
test eax, eax
je 0x1005f1c1
mov ecx, dword [esi + 4]
push eax
call dword [ecx]
add esp, 4
mov eax, dword [esi + 4]
cmp dword [eax + 4], 0
je 0x1005f1c1
mov esi, dword [esi]
cmp dword [eax + 8], 9
jae 0x1005f1b1
call sub.KERNEL32.dll_GetProcessHeap
push esi
jmp 0x1005f1b9
call sub.KERNEL32.dll_GetProcessHeap
push dword [esi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov esi, dword [edi + 4]
call sub.KERNEL32.dll_GetProcessHeap
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1005f1e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
mov eax, dword [ecx]
mov esi, ecx
test eax, eax
je 0x1005f210
cmp eax, 1
jne 0x1005f27f
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
je 0x1005f251
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
je 0x1005f25d
lea ecx, [esi + 0x18]
cmp dword [ecx], 0
je 0x1005f279
add esi, 0x20
jmp 0x1005f254
mov al, byte [esi + 0x28]
mov ecx, eax
and cl, 7
cmp cl, 3
je 0x1005f233
cmp al, 4
je 0x1005f27f
lea ecx, [esi + 8]
lea edi, [esi + 0x28]
call fcn.10065390
mov ecx, edi
call fcn.10065b00
mov eax, dword [esi + 0x118]
test eax, eax
je 0x1005f27f
lock dec dword [eax]
jne 0x1005f27f
add esi, 0x118
mov ecx, esi
pop esi
pop edi
jmp fcn.10116ed0
add esi, 0x10
mov ecx, esi
pop esi
pop edi
jmp 0x10065cb0
mov eax, dword [esi + 0x18]
lea ecx, [esi + 0x20]
or eax, dword [esi + 0x1c]
jne 0x1005f256
mov eax, dword [ecx]
xor eax, 3
or eax, dword [ecx + 4]
je 0x1005f27f
pop esi
pop edi
jmp fcn.10065b00
cmp byte [ecx + 4], 3
jne 0x1005f282
pop esi
pop edi
ret
add ecx, 4
pop esi
pop edi
jmp fcn.10065390
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 2
je 0x10065dc1
mov esi, ecx
test eax, eax
jne 0x10065cd1
add esi, 4
mov ecx, esi
pop esi
pop edi
pop ebx
jmp fcn.1005fbd0
cmp byte [esi + 8], 0
je 0x10065d75
cmp byte [esi + 0x50], 0xa
jb 0x10065cf8
cmp dword [esi + 0x58], 0
je 0x10065cf8
mov edi, dword [esi + 0x54]
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
cmp byte [esi + 0x64], 2
lea edi, [esi + 0x10]
jb 0x10065d27
mov eax, dword [esi + 0x68]
mov ecx, dword [eax + 0xc]
lea edx, [eax + 8]
push dword [eax + 4]
push dword [eax]
push edx
call dword [ecx + 4]
add esp, 0xc
mov ebx, dword [esi + 0x68]
call sub.KERNEL32.dll_GetProcessHeap
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x78]
lea ecx, [esi + 0x74]
push dword [esi + 0x70]
push dword [esi + 0x6c]
push ecx
call dword [eax + 4]
add esp, 0xc
mov eax, dword [esi + 0x88]
lea ecx, [esi + 0x84]
push dword [esi + 0x80]
push dword [esi + 0x7c]
push ecx
call dword [eax + 4]
add esp, 0xc
push edi
call fcn.1004fdd0
add esp, 4
lea ecx, [esi + 0x90]
call fcn.100570c0
lea ecx, [esi + 0x98]
call fcn.100547a0
mov edi, dword [esi + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x10065db0
mov ecx, dword [edi + 4]
push eax
call dword [ecx]
add esp, 4
mov eax, dword [edi + 4]
cmp dword [eax + 4], 0
je 0x10065db0
mov edi, dword [edi]
cmp dword [eax + 8], 9
jae 0x10065da0
call sub.KERNEL32.dll_GetProcessHeap
push edi
jmp 0x10065da8
call sub.KERNEL32.dll_GetProcessHeap
push dword [edi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov esi, dword [esi + 0xc]
call sub.KERNEL32.dll_GetProcessHeap
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
pop esi
pop edi
pop ebx
ret
Function at 0x10064af0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
mov esi, ecx
mov ecx, dword [ecx]
lea eax, [esi + 8]
or ecx, dword [esi + 4]
je 0x10064b29
mov edi, dword [eax]
mov eax, dword [edi]
test eax, eax
je 0x10064b57
mov ecx, dword [edi + 4]
push eax
call dword [ecx]
add esp, 4
mov eax, dword [edi + 4]
cmp dword [eax + 4], 0
je 0x10064b57
mov edi, dword [edi]
cmp dword [eax + 8], 9
jae 0x10064b47
call sub.KERNEL32.dll_GetProcessHeap
push edi
jmp 0x10064b4f
push eax
call fcn.1004fdd0
add esp, 4
lea ecx, [esi + 0x48]
call fcn.100570c0
add esi, 0x50
mov ecx, esi
pop esi
pop edi
pop ebx
jmp fcn.1005f350
call sub.KERNEL32.dll_GetProcessHeap
push dword [edi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov edi, dword [esi + 8]
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x10]
xor eax, 3
or eax, dword [esi + 0x14]
jne 0x10064b77
pop esi
pop edi
pop ebx
ret
cmp byte [esi + 0x50], 0xa
lea edi, [esi + 0x10]
jb 0x10064b97
cmp dword [esi + 0x58], 0
je 0x10064b97
mov ebx, dword [edi + 0x44]
call sub.KERNEL32.dll_GetProcessHeap
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapFree
cmp byte [edi + 0x54], 2
jb 0x10064bc3
mov eax, dword [esi + 0x68]
mov ecx, dword [eax + 0xc]
lea edx, [eax + 8]
push dword [eax + 4]
push dword [eax]
push edx
call dword [ecx + 4]
add esp, 0xc
mov ebx, dword [esi + 0x68]
call sub.KERNEL32.dll_GetProcessHeap
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x78]
lea ecx, [edi + 0x64]
push dword [esi + 0x70]
push dword [esi + 0x6c]
push ecx
call dword [eax + 4]
add esp, 0xc
mov eax, dword [esi + 0x88]
lea ecx, [edi + 0x74]
push dword [esi + 0x80]
push dword [esi + 0x7c]
push ecx
call dword [eax + 4]
add esp, 0xc
push edi
call fcn.1004fdd0
add esp, 4
lea ecx, [esi + 0x90]
call fcn.100570c0
add esi, 0x98
mov ecx, esi
pop esi
pop edi
pop ebx
jmp fcn.100547a0
Function at 0x10065b00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
mov eax, dword [ecx]
mov esi, ecx
test eax, eax
je 0x10065b6e
cmp eax, 1
jne 0x10065ca1
cmp dword [esi + 8], 0
je 0x10065c6a
mov eax, dword [esi + 0xc]
cmp eax, 2
je 0x10065ca1
add esi, 0x10
test eax, eax
je 0x10065c77
mov edi, dword [esi]
mov eax, dword [edi]
test eax, eax
je 0x10065c91
mov ecx, dword [edi + 4]
push eax
call dword [ecx]
add esp, 4
mov eax, dword [edi + 4]
cmp dword [eax + 4], 0
je 0x10065c91
mov edi, dword [edi]
cmp dword [eax + 8], 9
jae 0x10065c81
call sub.KERNEL32.dll_GetProcessHeap
push edi
jmp 0x10065c89
mov eax, dword [esi + 0x58]
lea edi, [esi + 8]
test eax, eax
je 0x10065b85
lock dec dword [eax]
jne 0x10065b85
lea ecx, [esi + 0x58]
call fcn.10061d70
cmp byte [edi + 0x54], 2
jb 0x10065bb1
mov eax, dword [esi + 0x60]
mov ecx, dword [eax + 0xc]
lea edx, [eax + 8]
push dword [eax + 4]
push dword [eax]
push edx
call dword [ecx + 4]
add esp, 0xc
mov ebx, dword [esi + 0x60]
call sub.KERNEL32.dll_GetProcessHeap
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x70]
lea ecx, [edi + 0x64]
push dword [esi + 0x68]
push dword [esi + 0x64]
push ecx
call dword [eax + 4]
add esp, 0xc
mov ecx, edi
call fcn.10065dd0
cmp byte [esi + 0x74], 2
jb 0x10065bf7
mov eax, dword [esi + 0x78]
mov ecx, dword [eax + 0xc]
lea edx, [eax + 8]
push dword [eax + 4]
push dword [eax]
push edx
call dword [ecx + 4]
add esp, 0xc
mov ebx, dword [esi + 0x78]
call sub.KERNEL32.dll_GetProcessHeap
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x88]
lea ecx, [edi + 0x7c]
push dword [esi + 0x80]
push dword [esi + 0x7c]
push ecx
call dword [eax + 4]
add esp, 0xc
mov eax, dword [esi + 0x98]
lea ecx, [edi + 0x8c]
push dword [esi + 0x90]
push dword [esi + 0x8c]
push ecx
call dword [eax + 4]
add esp, 0xc
mov eax, dword [esi + 0xa0]
test eax, eax
je 0x10065c4b
lock dec dword [eax]
jne 0x10065c4b
add esi, 0xa0
mov ecx, esi
call fcn.10116ed0
mov eax, dword [edi + 0xc4]
test eax, eax
je 0x10065ca1
lock dec dword [eax]
jne 0x10065ca1
add edi, 0xc4
mov ecx, edi
pop esi
pop edi
pop ebx
jmp fcn.10116ed0
add esi, 0x10
mov ecx, esi
pop esi
pop edi
pop ebx
jmp fcn.10065e30
mov ecx, esi
pop esi
pop edi
pop ebx
jmp fcn.1005fbd0
call sub.KERNEL32.dll_GetProcessHeap
push dword [edi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov esi, dword [esi]
call sub.KERNEL32.dll_GetProcessHeap
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
pop esi
pop edi
pop ebx
ret