joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002e9a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
cmp edi, ebx
je 0x1002e9b4
cmp dword [edi + 0x18], ebx
jne 0x1002e9bf
pop edi
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x7c], ebx
je 0x1002e9cd
push edi
call fcn.1002c830
add esp, 4
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push edi
call fcn.1002c630
add esp, 0x10
test eax, eax
je 0x1002e9f4
pop edi
mov eax, 0xffffff99
pop ebx
add esp, 8
ret
push esi
push 0x84
call fcn.10036cbb
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x1002ea35
push 0x4000
call fcn.10036cbb
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
add esp, 4
cmp eax, ebx
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
jne 0x1002ea41
push esi
call fcn.10036373
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
add esp, 8
ret
mov dword [esi + 0x40], ebx
mov edx, dword [edi + 0x34]
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp edx, ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0x1002ea8f
lea eax, [esi + 4]
push eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.1002bbb0
add esp, 4
test eax, eax
jne 0x1002ea8f
mov dword [esi + 0x40], 1
mov ecx, dword [edi + 0x40]
mov dword [esi + 0x58], ecx
mov edx, dword [edi + 0x44]
mov dword [esi + 0x5c], edx
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov ecx, dword [edi + 0x30]
shr ecx, 3
test cl, 1
je 0x1002eab9
mov dl, byte [edi + 0x39]
mov byte [esi + 0x80], dl
jmp 0x1002eac2
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
mov cl, byte [esi + 0x6c]
neg cl
push ebp
mov ebp, dword [esp + 0x20]
lea ebx, [esi + 0x70]
mov dword [ebx], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
sbb ecx, ecx
and ecx, 0xc
test ebp, ebp
mov dword [esi + 0x7c], ecx
je 0x1002eb06
nop
xor eax, eax
mov al, byte [ebp]
test al, al
je 0x1002eb06
push eax
push ebx
call fcn.1002b8d0
add esp, 8
inc ebp
jne 0x1002eaf0
mov edx, dword [edi + 0x78]
mov eax, dword [esp + 0x14]
lea ecx, [edx + eax + 0x1e]
pop ebp
mov dword [esi + 0x3c], ecx
mov dword [esi + 8], 0
mov dword [edi + 0x7c], esi
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x1002edf0
Capabilities:
Get common file path

Disassembly:
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x1002eeb2
cmp dword [edi + 4], 0xffffffff
jne 0x1002eeb2
push esi
lea esi, [edi + 0x244]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
call fcn.100363e4
mov ax, word [edi + eax*2 + 0x242]
add esp, 4
cmp ax, 0x5c
je 0x1002ee44
cmp ax, 0x2f
je 0x1002ee44
push 0x10048654
push esi
call fcn.100376cc
add esp, 8
mov esi, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x18]
cmp ebx, 1
jne 0x1002ee6f
push 1
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1002ee6f
pop ebx
pop esi
mov eax, 0x2000000
pop edi
ret 0xc
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push ebx
push ecx
push esi
call fcn.1002bc70
add esp, 0x10
test eax, eax
jne 0x1002ee91
mov eax, dword [esp + 0x18]
pop ebx
pop esi
pop edi
ret 0xc
push eax
call fcn.1002e7a0
add esp, 4
xor edx, edx
test eax, eax
setne dl
pop ebx
mov dword [edi], eax
pop esi
pop edi
dec edx
and edx, 0x200
mov eax, edx
ret 0xc
mov eax, 0x1000000
pop edi
ret 0xc
Function at 0x10031430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10045706
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
lea ecx, [esi + 0x24]
mov byte [esp + 0x14], 1
call fcn.1002f360
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x30], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x10031870
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100457a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x30]
push ebx
push ebp
mov ebp, dword [esp + 0x40]
push esi
xor ebx, ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0xc], ebx
mov esi, dword [esp + 0x40]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push esi
push eax
mov byte [esp + 0x40], 1
call dword [ecx + 0x90]
cmp eax, ebx
mov eax, dword [esp + 0xc]
jne 0x100319c0
cmp eax, ebx
je 0x100319c0
push edi
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor edi, edi
cmp eax, ebx
jle 0x10031992
lea ecx, [ecx]
mov dword [esp + 0x40], ebx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x40]
push edx
push edi
push eax
mov byte [esp + 0x44], 2
call dword [ecx + 0x1c]
cmp eax, ebx
mov eax, dword [esp + 0x40]
jne 0x10031976
cmp eax, ebx
je 0x10031976
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], 3
call fcn.1002f3f0
lea eax, [esp + 0x18]
push eax
mov ecx, ebp
call fcn.10031510
mov ecx, dword [esp + 0x2c]
push ecx
call esi
mov edx, dword [esp + 0x28]
push edx
call esi
mov eax, dword [esp + 0x24]
push eax
call esi
mov ecx, dword [esp + 0x20]
push ecx
call esi
mov edx, dword [esp + 0x1c]
push edx
call esi
mov eax, dword [esp + 0x18]
push eax
call esi
mov eax, dword [esp + 0x40]
cmp eax, ebx
mov byte [esp + 0x38], 1
je 0x10031985
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
inc edi
cmp edi, eax
jl 0x100318f0
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov byte [esp + 0x38], bl
pop edi
je 0x100319a5
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0x40]
push eax
call esi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
cmp eax, ebx
mov byte [esp + 0x34], bl
je 0x100319ce
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [esp + 0x2c]
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x100338a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10045a22
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x10048a18
mov dword [esp + 8], esi
mov dword [esi + 4], edi
mov dword [esp + 0x14], edi
mov dword [esi + 8], edi
mov eax, dword [0x100555f8]
mov ecx, 0x100555f8
mov byte [esp + 0x14], 1
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov edx, dword [0x100555f8]
mov ecx, 0x100555f8
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x20], eax
mov eax, dword [0x100555f8]
mov ecx, 0x100555f8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x24], eax
mov edx, dword [0x100555f8]
mov ecx, 0x100555f8
mov byte [esp + 0x14], 2
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x28], eax
mov eax, dword [0x100555f8]
mov ecx, 0x100555f8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x2c], eax
mov edx, dword [0x100555f8]
mov ecx, 0x100555f8
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10034be0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x1c]
xor eax, eax
push esi
mov esi, dword [esp + 0x18]
cmp esi, ebx
sete al
mov edx, ecx
push edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
mov eax, ebp
and eax, 7
je 0x10034c18
mov ecx, ebp
sub ecx, eax
add ecx, 8
mov dword [esp + 0x1c], ecx
jmp 0x10034c1e
mov dword [esp + 0x1c], ebp
mov ecx, ebp
xor edi, edi
test ecx, ecx
mov dword [esp + 0x20], edi
ja 0x10034c40
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 8
ret 0xc
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
lea esp, [esp]
mov eax, dword [esp + 0x14]
test eax, eax
lea eax, [ebp - 7]
je 0x10034c98
cmp edi, eax
jae 0x10034c63
lea ecx, [esi + 4]
push ecx
mov ecx, edx
push esi
call fcn.10034030
add esi, 8
jmp 0x10034d28
sub ecx, ebp
test ecx, ecx
lea edx, [esi + ebp]
jle 0x10034c82
mov edi, edx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
lea eax, [esi + 4]
push eax
push esi
call fcn.10034030
add esi, 8
jmp 0x10034d28
cmp edi, eax
jae 0x10034cd7
mov cl, byte [esi]
mov byte [ebx], cl
mov al, byte [esi + 1]
mov byte [ebx + 1], al
mov cl, byte [esi + 2]
mov byte [ebx + 2], cl
mov al, byte [esi + 3]
mov byte [ebx + 3], al
mov cl, byte [esi + 4]
lea eax, [ebx + 4]
mov byte [eax], cl
mov cl, byte [esi + 5]
mov byte [ebx + 5], cl
mov cl, byte [esi + 6]
mov byte [ebx + 6], cl
mov cl, byte [esi + 7]
push eax
mov byte [ebx + 7], cl
push ebx
mov ecx, edx
call fcn.10034030
jmp 0x10034d22
mov eax, ebp
sub eax, edi
xor ebp, ebp
test eax, eax
mov edi, ebx
jle 0x10034cf5
mov ecx, eax
mov ebp, eax
mov dl, byte [esi]
mov byte [edi], dl
inc edi
inc esi
dec ecx
jne 0x10034ce7
cmp eax, 8
jge 0x10034d0c
mov ecx, 8
sub ecx, ebp
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x10]
lea eax, [ebx + 4]
push eax
push ebx
call fcn.10034030
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
add esi, 8
add ebx, 8
mov eax, dword [esp + 0x1c]
add edi, 8
cmp edi, eax
mov dword [esp + 0x20], edi
jb 0x10034c34
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x10034d50
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
push edi
mov edi, dword [esp + 0x14]
cmp esi, edi
sete al
mov ebx, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
test eax, eax
jbe 0x10034dd4
push ebp
lea ebp, [eax - 1]
shr ebp, 3
inc ebp
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10034d91
lea ecx, [esi + 4]
push ecx
push esi
mov ecx, ebx
call fcn.100343f0
add esi, 8
jmp 0x10034dd0
mov dl, byte [esi]
mov byte [edi], dl
mov al, byte [esi + 1]
mov byte [edi + 1], al
mov cl, byte [esi + 2]
mov byte [edi + 2], cl
mov dl, byte [esi + 3]
mov byte [edi + 3], dl
mov cl, byte [esi + 4]
lea eax, [edi + 4]
mov byte [eax], cl
mov dl, byte [esi + 5]
mov byte [edi + 5], dl
mov cl, byte [esi + 6]
mov byte [edi + 6], cl
mov dl, byte [esi + 7]
push eax
push edi
mov ecx, ebx
mov byte [edi + 7], dl
call fcn.100343f0
add esi, 8
add edi, 8
dec ebp
jne 0x10034d78
pop ebp
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x10035c2a
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x1005454c]
xor eax, ebp
push esi
mov dword [ebp + 0x74], eax
mov esi, ecx
call fcn.10035bac
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.10038c40
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x10035c8e
cmp dword [ebp - 0x1c], 5
jb 0x10035ca6
jmp 0x10035ca2
cmp dword [ebp - 0x10], 1
jne 0x10035ca6
cmp dword [ebp - 0x1c], 4
ja 0x10035ca2
jne 0x10035ca6
cmp dword [ebp - 0x18], 0
jbe 0x10035ca6
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x710
mov dword [esi + 0x14], 0x1004b138
call fcn.10001140
test eax, eax
jge 0x10035cc7
mov byte [0x100553f4], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1003609d
add ebp, 0x78
leave
ret
Function at 0x10037434
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x10037524
mov eax, 0x94
call fcn.10036cd0
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10037599
mov ecx, dword [esi + 0x10]
mov dword [0x10055880], ecx
mov eax, dword [esi + 4]
mov dword [0x1005588c], eax
mov edx, dword [esi + 8]
mov dword [0x10055890], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x10055884], esi
je 0x1003749f
or esi, 0x8000
mov dword [0x10055884], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x10055888], eax
call fcn.10039779
test eax, eax
pop ecx
je 0x10037599
call fcn.1003ae98
test eax, eax
jne 0x100374cc
call fcn.100397ca
jmp 0x10037599
call fcn.1003c809
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10056f34], eax
call fcn.1003c6e7
mov dword [0x10055684], eax
call fcn.1003c1c8
test eax, eax
jl 0x1003751d
call fcn.1003c645
test eax, eax
jl 0x10037518
call fcn.1003c412
test eax, eax
jl 0x10037518
push 0
call fcn.1003b036
test eax, eax
pop ecx
jne 0x10037518
inc dword [0x10055680]
jmp 0x100375aa
call fcn.1003c3c6
call fcn.1003ac81
jmp 0x100374c2
test eax, eax
jne 0x10037554
cmp dword [0x10055680], eax
jle 0x10037599
dec dword [0x10055680]
cmp dword [0x100558bc], eax
jne 0x10037543
call fcn.1003b174
call fcn.1003c3c6
call fcn.1003ac81
call fcn.100397ca
jmp 0x100375aa
cmp eax, 2
jne 0x1003759d
push 0x8c
push 1
call fcn.100385f3
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10037599
push esi
push dword [0x1005483c]
call dword [0x10055874]
test eax, eax
push esi
je 0x10037593
call fcn.1003ac9e
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x100375aa
call fcn.10036373
pop ecx
xor eax, eax
jmp 0x100375ad
cmp eax, 3
jne 0x100375aa
push 0
call fcn.1003ae69
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc

Function at 0x10037ca3
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
xor ebx, ebx
test edi, edi
jne 0x10037cbf
call fcn.10038a17
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x10037d31
push esi
push 0x8c
push 1
call fcn.100385f3
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10037d17
push esi
call fcn.1003ac9e
mov eax, dword [esp + 0x1c]
pop ecx
push esi
push 4
push esi
push 0x10037c11
push dword [esp + 0x24]
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
mov dword [esi + 4], edi
je 0x10037d0f
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x10037d2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.10036373
test ebx, ebx
pop ecx
je 0x10037d29
push ebx
call fcn.10038a29
pop ecx
or eax, 0xffffffff
jmp 0x10037d30
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x1003841d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1003843d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10038a29
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x10038460
test byte [esp + 8], 2
je 0x10038460
call fcn.10038a17
mov dword [eax], 0xd
call fcn.10038a20
mov dword [eax], 5
jmp 0x10038439
xor eax, eax
ret

Function at 0x10038510
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.10036cd0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100385ab
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x10055880]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x100385ab
cmp eax, 1
je 0x100385cc
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100385ab
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x10038578
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x100385a7
xor eax, eax
inc eax
jmp 0x100385eb
cmp edi, eax
jae 0x100385af
xor eax, eax
jmp 0x100385eb
cmp eax, esi
jae 0x100385b6
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x10055880]
jmp 0x100385cf
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1003b0a0
Capabilities:
Terminate process

Disassembly:
push 8
push 0x1004b5e8
call fcn.10038ca0
push 8
call fcn.10039403
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x100558c0], esi
jne 0x1003b0d4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x100558bc], esi
mov al, byte [ebp + 0x10]
mov byte [0x100558b8], al
cmp dword [ebp + 0xc], edi
jne 0x1003b11e
cmp dword [0x10056f08], edi
je 0x1003b10e
mov eax, dword [0x10056f04]
sub eax, 4
invalid
invalid

Function at 0x1003ca10
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x1005454c]
mov ecx, dword [ebp + 0x98]
push ebx
xor eax, ebp
push esi
mov dword [ebp + 0x8c], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x10054a90]
je 0x1003ca47
inc eax
cmp eax, 0x13
jb 0x1003ca38
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x10054a90]
jne 0x1003cb6a
mov eax, dword [0x1005568c]
cmp eax, 1
je 0x1003cb45
cmp eax, edx
jne 0x1003ca77
cmp dword [0x10055690], 1
je 0x1003cb45
cmp ecx, 0xfc
je 0x1003cb6a
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edx
mov byte [ebp + 0x88], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1003caad
lea eax, [ebp - 0x7c]
push str._program_name_unknown_
push eax
call fcn.1003c0d0
pop ecx
pop ecx
lea edi, [ebp - 0x7c]
mov eax, edi
push eax
call fcn.10038d10
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1003cae1
mov eax, edi
push eax
call fcn.10038d10
mov edi, eax
lea eax, [ebp - 0x7c]
sub eax, 0x3b
push 3
add edi, eax
push 0x1004b334
push edi
call fcn.100386d0
add esp, 0x10
push edi
call fcn.10038d10
push dword [esi + 0x10054a94]
mov ebx, eax
call fcn.10038d10
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.10036cd0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.1003c0d0
push edi
push ebx
call fcn.1003c0e0
push 0x1004b330
push ebx
call fcn.1003c0e0
push dword [esi + 0x10054a94]
push ebx
call fcn.1003c0e0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.1003ee11
add esp, 0x2c
jmp 0x1003cb6a
push edx
lea eax, [ebp - 0x80]
push eax
lea esi, [esi + 0x10054a94]
push dword [esi]
call fcn.10038d10
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8c]
xor ecx, ebp
call fcn.1003609d
add ebp, 0x90
leave
ret
Function at 0x1003f5e5
Capabilities:
Write file on windows

Disassembly:
popfd
add byte [esi + 5], ch
adc byte [ebx + 0x2e6c103], cl
test byte [eax + esi + 4], 0x20
je 0x1003f60a
push 2
push ecx
push ecx
push dword [ebp + 0x3ac]
call fcn.10041279
add esp, 0x10
xor ecx, ecx
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x1003f6a4
cmp dword [ebp + 0x3b4], ecx
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x68], ecx
jbe 0x1003f707
jmp 0x1003f62e
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x64]
cmp ecx, dword [ebp + 0x3b4]
jae 0x1003f669
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x1003f65a
inc dword [ebp - 0x78]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x6c]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 0x400
jl 0x1003f63a
mov edi, eax
lea eax, [ebp - 0x64]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1003f6c8
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x1003f6d1
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x7c]
cmp eax, dword [ebp + 0x3b4]
jb 0x1003f62c
jmp 0x1003f6d1
push ecx
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b4]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1003f6c8
mov eax, dword [ebp - 0x80]
and dword [ebp - 0x68], 0
mov dword [ebp - 0x74], eax
jmp 0x1003f6d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x74]
test eax, eax
jne 0x1003f731
cmp dword [ebp - 0x68], eax
je 0x1003f704
push 5
pop esi
cmp dword [ebp - 0x68], esi
jne 0x1003f6f9
call fcn.10038917
mov dword [eax], 9
call fcn.10038920
mov dword [eax], esi
jmp 0x1003f72c
push dword [ebp - 0x68]
call fcn.10038929
pop ecx
jmp 0x1003f72c
mov edi, dword [ebp - 0x7c]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x1003f719
cmp byte [edi], 0x1a
jne 0x1003f719
xor eax, eax
jmp 0x1003f734
call fcn.10038917
mov dword [eax], 0x1c
call fcn.10038920
and dword [eax], 0
or eax, 0xffffffff
jmp 0x1003f734
sub eax, dword [ebp - 0x78]
pop esi
pop ebx
mov ecx, dword [ebp + 0x3a0]
xor ecx, ebp
pop edi
call fcn.10035f9d
add ebp, 0x3a4
leave
ret