joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cdcd8
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4cdda9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2c]
call fcn.004cdbfc
mov eax, dword [ebp - 0x2c]
mov edx, 0x4cddc0
call fcn.004050a4
jne 0x4cdd8b
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x28
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4cdd93
lea eax, [ebp - 4]
push eax
push 0x28
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x4cdd93
lea eax, [ebp - 0x14]
push eax
push 0x4cddc8
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x4cdd93
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.KERNEL32.DLL_GetLastError
test al, al
jne 0x4cdd93
push 0
push esi
call sub.user32.dll_ExitWindowsEx
jmp 0x4cdd93
push 0
push ebx
call sub.user32.dll_ExitWindowsEx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cddb0
lea eax, [ebp - 0x2c]
call fcn.00404c98
ret

Function at 0x4d40ac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405158
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4d40c5
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x10002cb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push esi
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.10005d20
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
call fcn.10005280
add esp, 0xc
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x1002f428
call sub.SHELL32.dll_SHGetKnownFolderPath
mov esi, dword [ebp + 8]
test eax, eax
jne 0x10002d1e
push dword [ebp - 0x14]
push esi
call fcn.10005010
add esp, 8
push edi
push str.BrightData_
push esi
call fcn.10005120
mov edx, dword [ebp - 0xc]
add esp, 8
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002d35
lea eax, [ebp - 8]
sub ecx, edi
push eax
push ecx
push edx
call fcn.10006410
add esp, 0xc
pop edi
test eax, eax
jne 0x10002d7e
push 0x14
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
call fcn.100066e0
push dword [ebp - 4]
call fcn.10004f30
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push eax
call fcn.100051c0
push dword [eax]
push esi
call fcn.10005120
add esp, 0x20
mov eax, dword [ebp - 8]
test eax, eax
je 0x10002d95
push eax
call fcn.100081fb
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x10002dac
push eax
call fcn.100081fb
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x10002dc3
push eax
call fcn.100081fb
add esp, 4
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x18]
push eax
call fcn.10004fc0
lea eax, [ebp - 0x10]
push eax
call fcn.10004fc0
add esp, 8
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10002eb0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call fcn.10005d20
lea eax, [ebp - 4]
push str.luminati
push eax
call fcn.10005120
add esp, 0xc
cmp dword [section..data], 0
je 0x10002f50
push dword [ebp - 4]
call fcn.10005a60
add esp, 4
test eax, eax
jne 0x10002f50
lea eax, [ebp - 4]
push esi
push eax
call fcn.10002cb0
push 0x5c
push dword [ebp - 4]
call fcn.10006e52
mov esi, eax
xor eax, eax
mov word [esi], ax
push dword [ebp - 4]
call fcn.10008233
push 0x1ff
push dword [ebp - 4]
call fcn.10008264
mov eax, 0x5c
mov word [esi], ax
push dword [ebp - 4]
call fcn.10008233
push 0x1ff
push dword [ebp - 4]
call fcn.10008264
add esp, 0x24
lea eax, [ebp - 4]
pop esi
push eax
call fcn.10004fc0
add esp, 4
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call fcn.10005d20
push 0x1ff
push dword [ebp - 8]
call fcn.10004c90
lea eax, [ebp - 8]
push eax
call fcn.10004fc0
push dword [ebp - 4]
call fcn.10008233
push 0x1ff
push dword [ebp - 4]
call fcn.10004c90
add esp, 0x1c
lea eax, [ebp - 4]
push eax
call fcn.10004fc0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x10002fa0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x10038198]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x25c]
xor esi, esi
push eax
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x258], esi
call fcn.10005d20
lea eax, [ebp - 0x25c]
push str.luminati
push eax
call fcn.10005120
add esp, 0xc
cmp dword [section..data], esi
je 0x1000300c
push dword [ebp - 0x25c]
call fcn.10005a60
add esp, 4
test eax, eax
jne 0x1000300c
lea eax, [ebp - 0x25c]
push eax
call fcn.10002cb0
add esp, 4
push dword [ebp - 0x25c]
lea eax, [ebp - 0x258]
push eax
call fcn.10005010
lea eax, [ebp - 0x258]
push str.perr_.sent
push eax
call fcn.10005120
add esp, 0x10
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
xor eax, eax
cmp ebx, 0xffffffff
cmove ebx, eax
test ebx, ebx
je 0x1000315b
push edi
jmp 0x10003060
lea eax, [ebp - 0x228]
push 0x1002ed04
push eax
call fcn.100050f0
add esp, 8
test eax, eax
jne 0x100030ea
push dword [ebp - 0x25c]
lea eax, [ebp - 0x258]
push eax
call fcn.10005010
lea eax, [ebp - 0x258]
push 0x1002ed18
push eax
call fcn.10005120
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.10005120
push 1
push 0xc
call fcn.100081bb
push dword [ebp - 0x258]
mov edi, eax
lea ecx, [edi + 8]
push ecx
call fcn.10005010
add esp, 0x28
test esi, esi
je 0x100030df
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
jmp 0x100030e4
mov dword [edi + 4], edi
mov esi, edi
mov dword [edi], 0
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10003060
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
je 0x1000315a
jmp 0x10003110
push dword [esi + 8]
call fcn.10008317
mov edi, esi
add esp, 4
mov esi, dword [esi]
mov ecx, dword [edi]
test ecx, ecx
je 0x1000312d
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x10003137
test esi, esi
je 0x10003137
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
lea eax, [edi + 8]
mov dword [edi], 0
push eax
mov dword [edi + 4], 0
call fcn.10004fc0
push edi
call fcn.100081fb
add esp, 8
test esi, esi
jne 0x10003110
pop edi
lea eax, [ebp - 0x258]
push eax
call fcn.10004fc0
lea eax, [ebp - 0x25c]
push eax
call fcn.10004fc0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop esi
pop ebx
call fcn.10008398
mov esp, ebp
pop ebp
ret
Function at 0x100031f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10039804]
sub esp, 0xc
test eax, eax
jne 0x100032fb
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
call fcn.10005d20
lea eax, [ebp - 0xc]
push str.channel.txt
push eax
call fcn.10005120
push dword [ebp - 0xc]
call fcn.100059f0
add esp, 0x10
test eax, eax
je 0x100032d8
push 0x1002ef08
push dword [ebp - 0xc]
call fcn.10005970
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x100032d8
push esi
push 2
push 0
push eax
call fcn.100074a6
push dword [ebp - 4]
call fcn.100078b9
push dword [ebp - 4]
mov esi, eax
call fcn.10007b00
add esp, 0x14
cmp esi, 0x32
jg 0x100032d7
lea eax, [ebp - 8]
push esi
push eax
call fcn.10004de0
push dword [ebp - 4]
push esi
push 1
push dword [ebp - 8]
call fcn.1000736b
mov eax, dword [ebp - 8]
add esp, 0x18
xor ecx, ecx
mov byte [esi + eax], 0
mov edx, dword [ebp - 8]
test esi, esi
jle 0x100032c9
mov al, byte [ecx + edx]
cmp al, 0x30
jl 0x100032ac
cmp al, 0x39
jle 0x100032c4
cmp al, 0x41
jl 0x100032b4
cmp al, 0x5a
jle 0x100032c4
cmp al, 0x61
jl 0x100032bc
cmp al, 0x7a
jle 0x100032c4
cmp al, 0x2e
je 0x100032c4
cmp al, 0x5f
jne 0x100032d7
inc ecx
cmp ecx, esi
jl 0x100032a1
push edx
push 0x10039804
call fcn.100051c0
add esp, 8
pop esi
lea eax, [ebp - 4]
push eax
call fcn.100059d0
lea eax, [ebp - 8]
push eax
call fcn.10004e10
lea eax, [ebp - 0xc]
push eax
call fcn.10004fc0
mov eax, dword [0x10039804]
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10003560
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x1002effc
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x10003591
imul eax, dword [ebp + 0x14], 0x64
pop edi
pop esi
inc eax
mov dword [0x10039324], eax
xor eax, eax
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100035af
imul eax, dword [ebp + 0x14], 0x64
pop edi
pop esi
add eax, 2
mov dword [0x10039324], eax
xor eax, eax
pop ebp
ret
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x100035d0
imul eax, dword [ebp + 0x14], 0x64
pop ebx
pop edi
pop esi
add eax, 3
mov dword [0x10039324], eax
xor eax, eax
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x10003690
Capabilities:
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
imul esi, dword [ebp + 0x14], 0x64
push edi
or edi, 0xffffffff
mov dword [ebp - 8], 0
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10003560
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp + 0x14], 0
mov dword [ebp - 4], 0
test eax, eax
je 0x1000380f
lea eax, [ebp + 0x14]
push eax
call fcn.10005d20
lea eax, [ebp + 0x14]
push str.luminati
push eax
call fcn.10005120
add esp, 0xc
cmp dword [section..data], 0
je 0x10003713
push dword [ebp + 0x14]
call fcn.10005a60
add esp, 4
test eax, eax
jne 0x10003713
lea eax, [ebp + 0x14]
push eax
call fcn.10002cb0
add esp, 4
push ebx
lea eax, [ebp + 0x14]
push 0x1002f00c
push eax
call fcn.10005120
push dword [ebp + 0x10]
lea eax, [ebp + 0x14]
push eax
call fcn.10005120
push dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
call fcn.10005010
lea eax, [ebp - 4]
push 0x1002f010
push eax
call fcn.10005120
push dword [ebp - 4]
call fcn.10008317
push dword [ebp + 0x14]
call fcn.100059f0
mov ebx, dword [ebp - 0x10]
add esp, 0x28
test eax, eax
je 0x100037b7
push ebx
push dword [ebp - 0xc]
push dword [ebp + 0x14]
call fcn.100035f0
add esp, 0xc
test eax, eax
jne 0x1000380c
push dword [ebp + 0x14]
call fcn.10008317
push dword [ebp + 0x14]
call fcn.100059f0
add esp, 8
test eax, eax
je 0x1000379e
push dword [ebp - 4]
push dword [ebp + 0x14]
call fcn.10008320
add esp, 8
push dword [ebp + 0x14]
call fcn.100059f0
add esp, 4
test eax, eax
je 0x100037b7
lea eax, [esi + 2]
mov dword [0x10039324], eax
jmp 0x1000380e
push str.rbe
push dword [ebp + 0x14]
call fcn.10005970
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
jne 0x100037ef
push str.wbe
push dword [ebp + 0x14]
call fcn.10005970
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
jne 0x100037ef
lea eax, [esi + 3]
mov dword [0x10039324], eax
jmp 0x1000380e
push eax
push ebx
push 1
push dword [ebp - 0xc]
call fcn.10007a7e
add esp, 0x10
cmp eax, ebx
je 0x1000380c
lea eax, [esi + 4]
mov dword [0x10039324], eax
jmp 0x1000380e
xor edi, edi
pop ebx
lea eax, [ebp + 0x14]
push eax
call fcn.10004fc0
lea eax, [ebp - 4]
push eax
call fcn.10004fc0
lea eax, [ebp - 8]
push eax
call fcn.100059d0
add esp, 0xc
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10004140
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push dword [ebp + 8]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 8], 0
xor esi, esi
call fcn.10005120
lea eax, [ebp - 4]
push 0x1002e69c
push eax
call fcn.10005120
push dword [ebp - 4]
call fcn.10008317
push esi
call fcn.1000819c
push 0x1002e6d8
push dword [ebp - 4]
call fcn.10005970
add esp, 0x20
mov dword [ebp - 8], eax
test eax, eax
jne 0x100041b8
push 0x1002e6e4
push dword [ebp - 4]
call fcn.10005970
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
jne 0x100041b8
call fcn.100080e3
imul esi, dword [eax], 0x64
inc esi
jmp 0x100041e3
push 0
call fcn.1000819c
push dword [ebp - 8]
push 1
push 1
push 0x1002e698
call fcn.10007a7e
add esp, 0x14
cmp eax, 1
je 0x100041e3
call fcn.100080e3
imul esi, dword [eax], 0x64
add esi, 2
lea eax, [ebp - 8]
push eax
call fcn.100059d0
push dword [ebp - 4]
call fcn.10008317
lea eax, [ebp - 4]
push eax
call fcn.10004fc0
add esp, 0xc
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10005660
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [ebp + 0x10]
push 2
push dword [edi]
call fcn.10009f25
add esp, 8
mov dword [edi], eax
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp + 0x10]
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 4]
push eax
push ecx
push ecx
push ecx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x100056a3
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
cmp dword [ebp - 4], ebx
jg 0x100056b7
pop ebx
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
inc eax
push esi
mov dword [ebp + 0x10], eax
lea esi, [eax + eax]
lea eax, [esi + 2]
push eax
push 0
call fcn.10009f25
add esp, 8
mov dword [ebp - 8], eax
xor ecx, ecx
mov word [eax], cx
push ecx
push ecx
push ecx
push ecx
mov word [esi + eax], cx
lea ecx, [ebp + 0x10]
push ecx
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
pop esi
test eax, eax
je 0x100056fd
pop ebx
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
test eax, eax
je 0x10005712
push eax
call fcn.100081fb
add esp, 4
mov dword [edi], 0
mov eax, dword [ebp - 8]
mov dword [edi], eax
xor eax, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10005720
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 0x18]
or esi, 0xffffffff
mov dword [ebp - 4], 0
mov eax, dword [edi]
test eax, eax
je 0x10005748
push eax
call fcn.100081fb
add esp, 4
mov dword [edi], 0
push ebx
push 0x1002fb10
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100054b0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x100057d2
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x100057d2
mov eax, dword [ebp - 4]
add eax, 2
push eax
call fcn.10009e93
mov dword [edi], eax
add esp, 4
mov dword [ebp + 0x18], eax
mov byte [eax], 0
mov ecx, dword [ebp - 4]
mov byte [eax + ecx], 0
mov ecx, dword [ebp - 4]
mov byte [eax + ecx + 1], 0
lea eax, [ebp - 4]
push eax
push dword [edi]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [edi], 0
mov esi, eax
jne 0x100057d2
push 0x1002fafa
call fcn.10009614
push dword [ebp + 0x18]
call fcn.100081fb
add esp, 8
mov ecx, dword [ebp + 0x1c]
pop ebx
test ecx, ecx
je 0x100057df
mov eax, dword [ebp - 4]
mov dword [ecx], eax
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10005ac0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x10038198]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x54], eax
or edi, 0xffffffff
mov eax, dword [ebp + 0x14]
xor ecx, ecx
mov dword [ebp - 0x5c], eax
lea ebx, [ebx]
movzx eax, word [ecx + 0x1002fb14]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x1a], ax
test ax, ax
jne 0x10005af0
lea eax, [ebp - 0x18]
push eax
call fcn.10005910
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.100068c0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10005bf5
push esi
call fcn.1000a809
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x60], eax
push ecx
push eax
call fcn.1000a82d
add esp, 0xc
test eax, eax
jne 0x10005bf5
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x54], ecx
lea eax, [eax*2 - 2]
cdq
mov edi, eax
cmp ecx, edx
jg 0x10005b65
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x58], eax
jl 0x10005b6f
cmp eax, edi
jb 0x10005b6f
mov eax, edi
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x58], eax
mov ecx, edx
push 0
push 2
push ecx
push eax
call fcn.1000af70
mov ecx, dword [ebp - 0x54]
mov edi, eax
mov eax, dword [ebp - 0x58]
neg eax
push 2
adc ecx, 0
neg ecx
push ecx
push eax
push dword [ebp - 0x60]
call fcn.1000abb4
mov eax, dword [ebp - 0x58]
add eax, 2
push eax
call fcn.10009e93
push esi
push dword [ebp - 0x58]
mov dword [ebx], eax
push 1
push eax
call fcn.1000736b
mov eax, dword [ebx]
xor ecx, ecx
add esp, 0x24
mov word [eax + edi*2], cx
mov eax, dword [ebp - 0x5c]
cmp edi, eax
jle 0x10005bf1
mov ebx, dword [ebx]
push eax
push 0xa
push ebx
call fcn.10006d40
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x10005bf1
sub eax, ebx
sar eax, 1
sub edi, eax
cmp edi, dword [ebp - 0x5c]
jle 0x10005bf1
lea eax, [edi + edi]
push eax
lea eax, [ecx + 2]
push eax
push ebx
call fcn.10008fb0
add esp, 0xc
xor edi, edi
jmp 0x10005c0a
mov eax, dword [ebx]
test eax, eax
je 0x10005c0a
push eax
call fcn.100081fb
add esp, 4
mov dword [ebx], 0
test esi, esi
je 0x10005c17
push esi
call fcn.1000a792
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008398
mov esp, ebp
pop ebp
ret

Function at 0x10005cd0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x10005ce0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push ebx
push esi
push edi
lea ecx, [ebp + 0xc]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [ebp + 0xc]
mov ebx, eax
push 1
lea edi, [ecx*4]
lea ecx, [edi + 4]
push ecx
call fcn.100081bb
push edi
mov esi, eax
push ebx
push esi
call fcn.1000b050
mov eax, dword [ebp + 8]
add esp, 0x14
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret
Function at 0x10005d40
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1003800c]
push ebx
push esi
push edi
xor ebx, ebx
xor esi, esi
xor edi, edi
mov dword [ebp - 4], ebx
cmp eax, 0xffffffff
je 0x10005d81
mov esi, dword [0x10038008]
mov ebx, eax
mov eax, dword [0x10038014]
mov edi, dword [0x10038010]
mov edx, dword [0x10038018]
mov ecx, dword [0x1003801c]
mov dword [ebp - 4], eax
jmp 0x10005e5b
cmp dword [0x10039a18], ebx
jne 0x10005da6
push 0x10039a18
mov dword [0x10039a18], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10005e32
mov ebx, dword [0x10039a1c]
mov eax, dword [0x10039a24]
mov edi, dword [0x10039a20]
mov edx, dword [0x10039a28]
movzx ecx, word [0x10039b2c]
mov dword [ebp - 4], eax
cmp ebx, 0xa
jg 0x10005e2b
jne 0x10005dd9
test edi, edi
jns 0x10005e2b
mov esi, 6
jmp 0x10005e38
cmp ebx, 6
jg 0x10005dd2
jne 0x10005e08
cmp edi, 3
jge 0x10005dd2
cmp edi, 2
jge 0x10005e01
cmp edi, 1
jge 0x10005dfa
test edi, edi
js 0x10005e24
mov esi, 3
jmp 0x10005e38
mov esi, 4
jmp 0x10005e38
mov esi, 5
jmp 0x10005e38
cmp ebx, 5
jg 0x10005e24
jne 0x10005e38
cmp edi, 2
jge 0x10005e24
cmp edi, 1
jge 0x10005e24
test edi, edi
js 0x10005e38
mov esi, 1
jmp 0x10005e38
mov esi, 2
jmp 0x10005e38
mov esi, 7
jmp 0x10005e38
xor ecx, ecx
xor edx, edx
xor eax, eax
mov dword [0x10038008], esi
mov dword [0x1003800c], ebx
mov dword [0x10038010], edi
mov dword [0x10038014], eax
mov dword [0x10038018], edx
mov dword [0x1003801c], ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x10005e64
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10005e6d
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x10005e76
mov dword [eax], edi
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x10005e82
mov esi, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
test eax, eax
je 0x10005e8e
mov dword [eax], edx
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x10005e97
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10005ea0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10038008]
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x10005fb7
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
xor edi, edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp dword [0x1003800c], eax
jne 0x10005fb4
cmp dword [0x10039a18], ebx
jne 0x10005ef7
push 0x10039a18
mov dword [0x10039a18], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10005f86
mov eax, dword [0x10039a24]
mov ebx, dword [0x10039a1c]
mov edi, dword [0x10039a20]
mov dword [ebp - 4], eax
mov eax, dword [0x10039a28]
mov dword [ebp - 8], eax
movzx eax, word [0x10039b2c]
mov dword [ebp - 0xc], eax
cmp ebx, 0xa
jg 0x10005f81
jne 0x10005f2f
test edi, edi
jns 0x10005f81
mov esi, 6
jmp 0x10005f86
cmp ebx, 6
jg 0x10005f28
jne 0x10005f5e
cmp edi, 3
jge 0x10005f28
cmp edi, 2
jge 0x10005f57
cmp edi, 1
jge 0x10005f50
test edi, edi
js 0x10005f7a
mov esi, 3
jmp 0x10005f86
mov esi, 4
jmp 0x10005f86
mov esi, 5
jmp 0x10005f86
cmp ebx, 5
jg 0x10005f7a
jne 0x10005f86
cmp edi, 2
jge 0x10005f7a
cmp edi, 1
jge 0x10005f7a
test edi, edi
js 0x10005f86
mov esi, 1
jmp 0x10005f86
mov esi, 2
jmp 0x10005f86
mov esi, 7
mov ecx, dword [ebp - 4]
mov eax, esi
mov dword [0x10038014], ecx
mov ecx, dword [ebp - 8]
mov dword [0x10038018], ecx
mov ecx, dword [ebp - 0xc]
mov dword [0x10038008], eax
mov dword [0x1003800c], ebx
mov dword [0x10038010], edi
mov dword [0x1003801c], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret