joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e2ec
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001e41c
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1001e410
mov dword [ebp - 0x18], 0x4020
mov dword [ebp - 0x24], 0x10007870
cmp dword [ebp - 0x18], 0x4327
jle 0x1001e3e0
and dword [ebp - 0x14], 0
jmp 0x1001e33a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3bd5
jge 0x1001e3e0
and dword [ebp - 0x10], 0
jmp 0x1001e354
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x5635
jge 0x1001e3db
and dword [ebp - 8], 0
jmp 0x1001e36a
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x31fa
jge 0x1001e3d6
and dword [ebp - 0xc], 0
jmp 0x1001e380
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x1670
jge 0x1001e3d4
mov eax, dword [ebp - 8]
cdq
idiv dword [ebp - 0xc]
and edx, dword [ebp - 0x10]
xor edx, dword [ebp - 0x14]
mov eax, edx
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x58]
call fcn.100252df
jmp 0x1001e379
jmp 0x1001e363
jmp 0x1001e34d
jmp 0x1001e333
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0
push 0x225f
push 0x7ebc
call fcn.10025011
add esp, 0x10
cmp dword [ebp - 0x18], 0x3e7f
jge 0x1001e40e
push dword [ebp - 0x24]
call fcn.1008287d
pop ecx
jmp 0x1001e41a
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
jmp 0x1001e470
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1001e458
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1001e456
push 0
push 0x1fb2
call fcn.1001e4a0
pop ecx
pop ecx
jmp 0x1001e470
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1001e470
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esp, ebp
pop ebp
ret
Function at 0x1002784f
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x10], 0x551a
mov dword [ebp - 0x18], 0x10008334
cmp dword [ebp - 0x10], 0x5555
jle 0x100278fe
and dword [ebp - 4], 0
jmp 0x1002787d
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x2869
jge 0x100278fe
and dword [ebp - 8], 0
jmp 0x10027893
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x45c2
jge 0x100278f9
and dword [ebp - 0xc], 0
jmp 0x100278a9
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3c4b
jge 0x100278f7
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
cdq
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x3c]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x3c]
call fcn.100252df
jmp 0x100278a2
jmp 0x1002788c
jmp 0x10027876
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.1002a570
add esp, 0xc
cmp dword [ebp - 0x10], 0x5295
jge 0x10027920
push dword [ebp - 0x18]
call fcn.1008287d
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10028722
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10028753
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push 0x3c3d
call fcn.10028790
add esp, 0x10
jmp 0x1002878c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10028775
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x1002878c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x10028df8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10028fe0
lea eax, [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0x67b8
mov dword [ebp - 0x24], 0x100085a0
cmp dword [ebp - 0x20], 0x67d7
jle 0x10028e9b
and dword [ebp - 0xc], 0
jmp 0x10028e37
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2927
jge 0x10028e9b
and dword [ebp - 0x18], 0
jmp 0x10028e4d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x21e9
jge 0x10028e99
mov eax, dword [ebp - 0xc]
and eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [ebp - 0x30], ax
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea ecx, [ebp - 0x6c]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.100252df
jmp 0x10028e46
jmp 0x10028e30
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x20], 0x64e8
jge 0x10028eb3
push dword [ebp - 0x24]
call fcn.1008287d
pop ecx
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x10028ecc
push 0
push 0
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x10028fde
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10028eee
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0x12
jg 0x10028f15
push 1
push 0x6fb
push 0x4cfb
push 1
push 0x6a9c
push 1
call fcn.10028158
add esp, 0x18
jmp 0x10028ee3
mov dword [ebp - 0x1c], 0x3580
mov dword [ebp - 0x2c], 0x100085ec
cmp dword [ebp - 0x1c], 0x35aa
jle 0x10028fcc
and dword [ebp - 8], 0
jmp 0x10028f3d
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x7962
jge 0x10028fcc
and dword [ebp - 0x10], 0
jmp 0x10028f57
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x38c3
jge 0x10028fc7
and dword [ebp - 0x14], 0
jmp 0x10028f6d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x5481
jge 0x10028fc5
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
sar eax, cl
mov ecx, dword [ebp - 0x14]
shl eax, cl
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 0x54], eax
push dword [ebp - 0x44]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x84]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x84]
call fcn.100252df
jmp 0x10028f66
jmp 0x10028f50
jmp 0x10028f36
cmp dword [ebp - 0x1c], 0x31b6
jge 0x10028fde
push dword [ebp - 0x2c]
call fcn.1008287d
pop ecx
jmp 0x10028fe8
push 0
call fcn.1002b72e
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002994d
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10029974
push 1
push 0xb20
push 0x22fd
call fcn.10029a03
add esp, 0xc
jmp 0x100299ff
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100299e3
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100299c4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x100299e1
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10025597
mov dword [eax], 0xfffffff6
jmp 0x100299b9
jmp 0x100299ff
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100299ff
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esp, ebp
pop ebp
ret

Function at 0x10029a03
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 0x14], 0x3ad9
mov dword [ebp - 0x1c], 0x100086ec
cmp dword [ebp - 0x14], 0x3dbe
jle 0x10029ad7
and dword [ebp - 4], 0
jmp 0x10029a31
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x5f0a
jge 0x10029ad7
and dword [ebp - 8], 0
jmp 0x10029a4b
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x4b1b
jge 0x10029ad2
and dword [ebp - 0xc], 0
jmp 0x10029a61
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x120
jge 0x10029acd
and dword [ebp - 0x10], 0
jmp 0x10029a77
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x4358
jge 0x10029acb
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 0x10]
or eax, ecx
cdq
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x40]
call fcn.100252df
jmp 0x10029a70
jmp 0x10029a5a
jmp 0x10029a44
jmp 0x10029a2a
push 1
push dword [ebp + 0x10]
push 0x6971
push dword [ebp + 8]
push 0x24f6
push 0x236c
push dword [ebp + 0xc]
push 1
call fcn.10029cb9
add esp, 0x20
cmp dword [ebp - 0x14], 0x38f1
jge 0x10029b0d
push dword [ebp - 0x1c]
call fcn.1008287d
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002c73a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 0x5a89
mov dword [ebp - 0x14], 0x10008ba0
cmp dword [ebp - 0xc], 0x5c1c
jle 0x1002c7c9
and dword [ebp - 4], 0
jmp 0x1002c764
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x29ca
jge 0x1002c7c9
and dword [ebp - 8], 0
jmp 0x1002c77a
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1f41
jge 0x1002c7c7
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
sar eax, cl
cdq
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x38]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x38]
call fcn.100252df
jmp 0x1002c773
jmp 0x1002c75d
push 0x166f
push dword [ebp + 0xc]
push 0x5427
push 1
push 0x58dd
push 1
push dword [ebp + 8]
call fcn.1002c800
add esp, 0x1c
cmp dword [ebp - 0xc], 0x58d2
jge 0x1002c7fc
push dword [ebp - 0x14]
call fcn.1008287d
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002e97f
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1002eb0c
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1002e9c6
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
jmp 0x1002eb0a
mov dword [ebp - 0x20], 0x4233
mov dword [ebp - 0x38], 0x10009078
cmp dword [ebp - 0x20], 0x44e3
jle 0x1002ea92
and dword [ebp - 0xc], 0
jmp 0x1002e9ee
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x5f71
jge 0x1002ea92
and dword [ebp - 4], 0
jmp 0x1002ea08
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x3285
jge 0x1002ea8d
and dword [ebp - 8], 0
jmp 0x1002ea1e
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x16d
jge 0x1002ea88
and dword [ebp - 0x10], 0
jmp 0x1002ea34
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xd7e
jge 0x1002ea86
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 8]
and eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x10]
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x54], eax
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x80]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x80]
call fcn.100252df
jmp 0x1002ea2d
jmp 0x1002ea17
jmp 0x1002ea01
jmp 0x1002e9e7
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x14], 0
jmp 0x1002eaa9
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1002eabc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x68], 1
jmp 0x1002eaa2
mov dword [ebp - 0x18], 0
jmp 0x1002eacc
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x1002eaf8
mov dword [ebp - 0x34], 7
push 0x1a48
lea eax, [ebp - 0x34]
push eax
push 0
push 0x40f1
push 0x5303
call fcn.1004952e
add esp, 0x14
jmp 0x1002eac5
cmp dword [ebp - 0x20], 0x40e0
jge 0x1002eb0a
push dword [ebp - 0x38]
call fcn.1008287d
pop ecx
jmp 0x1002eb51
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3c]
push 0
push dword [ebp - 0x40]
push 0x554d
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
call fcn.1002a23a
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x1004e961
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1004ea59
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1004e9a4
mov byte [ebp - 1], 0
push 0x6bcd
lea eax, [ebp - 1]
push eax
push 0
push 0x241
call fcn.100757ea
add esp, 0x10
jmp 0x1004ea57
mov dword [ebp - 0x10], 0x2736
mov dword [ebp - 0x1c], 0x1000b2e0
cmp dword [ebp - 0x10], 0x2ad8
jle 0x1004ea2b
and dword [ebp - 8], 0
jmp 0x1004e9c8
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x373b
jge 0x1004ea2b
and dword [ebp - 0xc], 0
jmp 0x1004e9de
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x7e3a
jge 0x1004ea29
mov eax, dword [ebp - 8]
or eax, dword [ebp - 0xc]
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x48]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x48]
call fcn.100252df
jmp 0x1004e9d7
jmp 0x1004e9c1
mov byte [ebp - 2], 0
cmp dword [ebp - 0x10], 0x2623
jge 0x1004ea41
push dword [ebp - 0x1c]
call fcn.1008287d
pop ecx
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1004ea57
push 0
push 0x2fe0
call fcn.1004f677
pop ecx
pop ecx
jmp 0x1004ea75
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x20]
push 0
push dword [ebp - 0x24]
call fcn.1004e325
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1005360d
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10053638
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0x3f74
push dword [ebp - 8]
push 0
call fcn.1006beb9
add esp, 0xc
jmp 0x100536c3
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100536a7
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10053688
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x100536a5
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.10025597
mov dword [eax], 0xcd9d75
jmp 0x1005367d
jmp 0x100536c3
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x100536c3
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esp, ebp
pop ebp
ret
Function at 0x10053f59
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10053fa4
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10053f98
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10053f96
push 0
push 0x3033
push 0x1211
call fcn.1006263f
add esp, 0xc
jmp 0x10053fa2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x10053fac
push 0
call fcn.10053f48
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10055809
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10055887
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1005587d
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10055861
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1005587b
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10025597
and dword [eax], 0
jmp 0x10055856
jmp 0x10055885
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x100558a4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push 0x77f8
push 0x505a
push 0
call fcn.10051aee
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1005c6e2
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1005c850
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1005c717
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
jmp 0x1005c84e
mov dword [ebp - 0x14], 0x3738
mov dword [ebp - 0x20], 0x1000c6b8
cmp dword [ebp - 0x14], 0x377d
jle 0x1005c7eb
and dword [ebp - 4], 0
jmp 0x1005c73f
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x2bdd
jge 0x1005c7eb
and dword [ebp - 8], 0
jmp 0x1005c759
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x781
jge 0x1005c7e6
and dword [ebp - 0xc], 0
jmp 0x1005c773
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x7d60
jge 0x1005c7e1
and dword [ebp - 0x10], 0
jmp 0x1005c789
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2c12
jge 0x1005c7df
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
sar eax, cl
mov ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 0x10]
and eax, ecx
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x50]
push dword [ebp - 0x54]
lea ecx, [ebp - 0x6c]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.100252df
jmp 0x1005c782
jmp 0x1005c76c
jmp 0x1005c752
jmp 0x1005c738
cmp dword [ebp - 0x14], 0x367f
jge 0x1005c7fd
push dword [ebp - 0x20]
call fcn.1008287d
pop ecx
mov dword [ebp - 0x38], 0x571177e8
mov dword [ebp - 0x34], 0xad4351cd
mov dword [ebp - 0x24], 0x3208af06
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x30], 0
push 0x75e3
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
push 0
call fcn.1005cb3e
add esp, 0x20
jmp 0x1005c87e
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push 0
call fcn.1004eeef
add esp, 0x14
mov esp, ebp
pop ebp
ret