joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x100015b0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10001623
cmp eax, 2
jne 0x10001609
mov eax, dword [esp + 4]
cmp eax, 4
ja 0x100015e6
mov eax, 4
jmp 0x10001623
cmp eax, 5
jne 0x10001602
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x100015f5
jmp 0x10001623
xor eax, eax
cmp ecx, 1
setne al
add eax, 6
jmp 0x10001623
mov eax, 8
jmp 0x10001623
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x10001618
mov eax, 1
jmp 0x10001623
xor eax, eax
cmp ecx, 0xa
setne al
add eax, 2
test eax, eax
mov byte [0x10027c36], al
je 0x1000163f
cmp eax, 1
je 0x1000163f
cmp eax, 4
je 0x1000163f
xor eax, eax
add esp, 0x94
ret
mov eax, 0x1a0
add esp, 0x94
ret

Function at 0x10002b50
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push ebx
call fcn.100023e0
add eax, 7
add esp, 4
cdq
and edx, 7
add eax, edx
mov esi, eax
sar esi, 3
mov dword [esp + 8], esi
mov eax, esi
dec esi
test eax, eax
jle 0x10002bbc
push edi
mov edi, dword [esp + 0x18]
push ebp
mov eax, esi
cdq
and edx, 3
add eax, edx
mov ebp, eax
mov eax, esi
cdq
xor eax, edx
sub eax, edx
and eax, 3
xor eax, edx
sar ebp, 2
mov ecx, eax
mov dword [esp + 0x18], ebp
mov ebp, dword [ebx]
sub ecx, edx
mov edx, dword [esp + 0x18]
shl ecx, 3
mov eax, dword [ebp + edx*4]
shr eax, cl
inc edi
mov ecx, esi
dec esi
test ecx, ecx
mov byte [edi - 1], al
jg 0x10002b7f
pop ebp
pop edi
mov eax, dword [esp + 8]
pop esi
pop ebx
pop ecx
ret
Function at 0x10009600
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x10]
mov eax, fcn.10010dd0
mov dword [0x1002ebf8], 0x1001bad0
mov dword [0x1002ebb4], eax
mov dword [0x1002ec30], eax
mov dword [esi + 0x1e07], 0x1001baf0
mov ecx, dword [0x1002ebb4]
mov eax, ecx
xor edx, edx
div ebx
push 0x1002eb94
push 0x40
sub ecx, edx
xor edx, edx
mov edi, ecx
mov ecx, ebx
add ecx, 0x1001d720
mov dword [0x1002ebb4], edi
inc ecx
mov eax, ecx
div ebx
sub ecx, edx
sub ecx, edi
push ecx
push edi
mov dword [0x1002ec54], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10009696
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x1748], eax
mov eax, 0x1ed
pop edi
pop esi
pop ebx
add esp, 0x24
ret
xor eax, eax
mov ecx, dword [esi + 0x1e07]
cmp byte [eax + ecx], 0xc3
je 0x100096aa
inc eax
cmp eax, 0x64
jb 0x10009698
cmp eax, 0x64
jne 0x100096bb
mov eax, 0x1f3
pop edi
pop esi
pop ebx
add esp, 0x24
ret
mov edx, dword [esi + 0x1e07]
inc eax
add edx, eax
mov dword [esi + 0x1e07], edx
mov eax, edx
mov edx, 0x1001d720
sub edx, eax
inc edx
xor eax, eax
mov dword [esi + 0x1e0b], edx
mov ecx, dword [0x1002ec30]
cmp dword [eax + ecx], 0x9bd7edd9
je 0x100096f1
inc eax
cmp eax, 0x64
jb 0x100096e2
cmp eax, 0x64
jne 0x10009702
mov eax, 0x1f4
pop edi
pop esi
pop ebx
add esp, 0x24
ret
jae 0x10009710
cmp byte [eax + ecx], 0xcc
je 0x10009710
inc eax
cmp eax, 0x64
jb 0x10009704
cmp eax, 0x64
jne 0x10009721
mov eax, 0x1f4
pop edi
pop esi
pop ebx
add esp, 0x24
ret
lea eax, [ecx + eax + 1]
pop edi
mov dword [0x1002ec30], eax
pop esi
mov byte [0x1002ebe8], 0
xor eax, eax
pop ebx
add esp, 0x24
ret

Function at 0x10009770
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1002ec30]
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, esi
push edi
sub ebx, eax
xor ecx, ecx
mov eax, ebx
xor edx, edx
mov edi, 0xeb
div edi
mov al, bl
xor al, 0x5a
mov dl, byte [edx + 0x10026530]
add dl, al
mov al, byte [ecx + esi]
xor al, dl
inc ebx
mov byte [ecx + esi], al
inc ecx
cmp ecx, 0x14
jl 0x10009782
pop edi
pop esi
pop ebx
ret
Function at 0x1000ce60
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x34
lea eax, [esp]
push ebx
push esi
push 0x32
push eax
push str.DD_ERRCODE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x1000ce84
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0x34
ret
lea ecx, [esp + 8]
test ecx, ecx
jne 0x1000ce95
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0x34
ret
mov esi, 0x1002b41c
lea eax, [esp + 8]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x1000cec6
test cl, cl
je 0x1000cec2
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x1000cec6
add eax, 2
add esi, 2
test cl, cl
jne 0x1000ce9e
xor eax, eax
jmp 0x1000cecb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000d020
mov esi, 0x1002b418
lea eax, [esp + 8]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x1000cf04
test cl, cl
je 0x1000cf00
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x1000cf04
add eax, 2
add esi, 2
test cl, cl
jne 0x1000cedc
xor eax, eax
jmp 0x1000cf09
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000d020
mov esi, 0x1002b414
lea eax, [esp + 8]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x1000cf42
test cl, cl
je 0x1000cf3e
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x1000cf42
add eax, 2
add esi, 2
test cl, cl
jne 0x1000cf1a
xor eax, eax
jmp 0x1000cf47
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000d015
mov esi, 0x1002b410
lea eax, [esp + 8]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x1000cf80
test cl, cl
je 0x1000cf7c
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x1000cf80
add eax, 2
add esi, 2
test cl, cl
jne 0x1000cf58
xor eax, eax
jmp 0x1000cf85
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000d015
mov esi, str.soft
lea eax, [esp + 8]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x1000cfbe
test cl, cl
je 0x1000cfba
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x1000cfbe
add eax, 2
add esi, 2
test cl, cl
jne 0x1000cf96
xor eax, eax
jmp 0x1000cfc3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000d00a
mov esi, str.SOFT
lea eax, [esp + 8]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x1000cff8
test cl, cl
je 0x1000cff4
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x1000cff8
add eax, 2
add esi, 2
test cl, cl
jne 0x1000cfd0
xor eax, eax
jmp 0x1000cffd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000d00a
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0x34
ret
mov eax, 2
pop esi
pop ebx
add esp, 0x34
ret
mov eax, 1
pop esi
pop ebx
add esp, 0x34
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x34
ret

Function at 0x1000d030
Capabilities:
Identify system language via api

Disassembly:
push esi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and eax, 0xff
cmp ax, 0xc
jne 0x1000d049
mov esi, 1
cmp ax, 7
jne 0x1000d054
mov esi, 2
cmp ax, 0xa
jne 0x1000d05f
mov esi, 3
mov eax, esi
pop esi
ret
Function at 0x1000dc20
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov eax, dword [0x1002ec4c]
sub esp, 0x28
push ebx
push ebp
push esi
push edi
push str.OpenThread
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x1000dc4b
mov eax, 0x211
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 4
mov dword [esp + 0x1c], eax
call dword [0x1002f580]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x18], esi
jne 0x1000dc81
mov eax, 0x20e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x1c
push ecx
push esi
call dword [0x1002f874]
test eax, eax
jne 0x1000dca6
mov eax, 0x20f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
cmp dword [esp + 0x1c], 0x10
jb 0x1000dd21
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ebp, dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
cmp eax, edx
jne 0x1000dd0a
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
cmp eax, ecx
je 0x1000dd0a
cmp eax, dword [0x10029ce7]
je 0x1000dd0a
push eax
push 0
push 2
call edi
mov esi, eax
test esi, esi
je 0x1000dd2e
mov eax, dword [esp + 0x3c]
push esi
test eax, eax
je 0x1000dcf8
call ebx
cmp eax, 0xffffffff
je 0x1000dd3b
jmp 0x1000dcff
call ebp
cmp eax, 0xffffffff
je 0x1000dd48
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
push esi
call dword [0x1002f590]
test eax, eax
je 0x1000dd55
cmp dword [esp + 0x1c], 0x10
jae 0x1000dcb9
mov eax, 0x212
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
mov eax, 0x20d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
mov eax, 0x210
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
mov eax, 0x20c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x40]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret

Function at 0x1001d820
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push esi
xor esi, esi
test eax, eax
jle 0x1001d87b
push edi
mov edi, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x18]
push ebx
mov eax, esi
cdq
idiv dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov cl, byte [edx + eax]
mov dl, byte [esi + edi]
xor dl, cl
mov eax, esi
mov byte [esi + edi], dl
mov cl, dl
cdq
idiv dword [esp + 0x20]
mov ebx, edx
mov dl, byte [ebx + ebp]
push edx
push ecx
call fcn.1001d7e0
mov byte [esi + edi], al
mov cl, byte [ebx + ebp]
xor cl, al
mov eax, dword [esp + 0x20]
add esp, 8
mov byte [esi + edi], cl
inc esi
cmp esi, eax
jl 0x1001d836
pop ebx
pop ebp
pop edi
xor eax, eax
pop esi
ret
Function at 0x1001e150
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 1
jne 0x1001e25c
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, dword [0x1002f0ec]
mov dword [0x1002f160], eax
test ecx, ecx
jne 0x1001e1b0
cmp al, 3
jne 0x1001e187
test eax, 0x80000000
je 0x1001e187
push 2
call fcn.100208b0
add esp, 4
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1001e1b0
push str.IsTNT
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001e1b0
push 1
call fcn.100208b0
add esp, 4
call fcn.1001e600
test eax, eax
jne 0x1001e1bc
ret 0xc
mov ecx, dword [0x1002f160]
xor edx, edx
mov eax, ecx
mov dl, ch
and eax, 0xff
mov dword [0x1002f16c], edx
mov dword [0x1002f168], eax
shl eax, 8
add eax, edx
shr ecx, 0x10
mov dword [0x1002f164], eax
mov dword [0x1002f160], ecx
call fcn.1001fc60
test eax, eax
jne 0x1001e1fe
call fcn.1001e640
xor eax, eax
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x100309f4], eax
call fcn.10020750
mov ecx, dword [0x100309f4]
mov dword [0x1002f0e0], eax
test ecx, ecx
je 0x1001e24d
test eax, eax
je 0x1001e24d
call fcn.1001fe30
call fcn.10020740
call fcn.10020190
call fcn.100200a0
call fcn.1001fb00
mov eax, dword [0x1002f0dc]
inc eax
mov dword [0x1002f0dc], eax
mov eax, 1
ret 0xc
call fcn.1001fcc0
call fcn.1001e640
xor eax, eax
ret 0xc
test eax, eax
jne 0x1001e29c
mov eax, dword [0x1002f0dc]
test eax, eax
jle 0x1001e297
mov ecx, eax
mov eax, dword [0x1002f198]
dec ecx
test eax, eax
mov dword [0x1002f0dc], ecx
jne 0x1001e280
call fcn.1001fb50
call fcn.10020040
call fcn.1001fcc0
call fcn.1001e640
mov eax, 1
ret 0xc
xor eax, eax
ret 0xc
cmp eax, 3
jne 0x1001e2ab
push 0
call fcn.1001fd90
add esp, 4
mov eax, 1
ret 0xc

Function at 0x1001fb60
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
call fcn.1001fc20
mov eax, dword [0x1002f19c]
mov ebp, dword [esp + 0x10]
cmp eax, 1
jne 0x1001fb84
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x1002f198], 1
mov byte [0x1002f194], bl
jne 0x1001fbde
mov ecx, dword [0x100309e8]
test ecx, ecx
je 0x1001fbcc
mov esi, dword [0x100309e4]
sub esi, 4
cmp esi, ecx
jb 0x1001fbcc
mov eax, dword [esi]
test eax, eax
je 0x1001fbc5
call eax
mov ecx, dword [0x100309e8]
sub esi, 4
cmp esi, ecx
jae 0x1001fbb7
push 0x1002601c
push 0x10026014
call fcn.1001fc40
add esp, 8
push 0x10026024
push 0x10026020
call fcn.1001fc40
add esp, 8
test ebx, ebx
je 0x1001fbfd
call fcn.1001fc30
pop esi
pop ebp
pop ebx
ret
push ebp
mov dword [0x1002f19c], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1001fc60
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.1001e3d0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x1002d998], eax
je 0x1001fcb8
push 0x74
push 1
call fcn.10021400
mov esi, eax
add esp, 8
test esi, esi
je 0x1001fcb8
mov eax, dword [0x1002d998]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1001fcb8
push esi
call fcn.1001fcf0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x1001fd10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x1002d998]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1001fd7e
push 0x74
push 1
call fcn.10021400
mov esi, eax
add esp, 8
test esi, esi
je 0x1001fd74
mov ecx, dword [0x1002d998]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1001fd74
push esi
call fcn.1001fcf0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret
push 0x10
call fcn.1001e370
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret

Function at 0x1001fd90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1002d998]
cmp eax, 0xffffffff
je 0x1001fe2c
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x1001fdb4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x1001fe1d
mov eax, dword [esi + 0x24]
test eax, eax
je 0x1001fdc4
push eax
call fcn.1001db30
add esp, 4
mov eax, dword [esi + 0x28]
test eax, eax
je 0x1001fdd4
push eax
call fcn.1001db30
add esp, 4
mov eax, dword [esi + 0x30]
test eax, eax
je 0x1001fde4
push eax
call fcn.1001db30
add esp, 4
mov eax, dword [esi + 0x38]
test eax, eax
je 0x1001fdf4
push eax
call fcn.1001db30
add esp, 4
mov eax, dword [esi + 0x40]
test eax, eax
je 0x1001fe04
push eax
call fcn.1001db30
add esp, 4
mov eax, dword [esi + 0x44]
test eax, eax
je 0x1001fe14
push eax
call fcn.1001db30
add esp, 4
push esi
call fcn.1001db30
add esp, 4
mov eax, dword [0x1002d998]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
ret
Function at 0x10020750
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x1002f3cc]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
xor esi, esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
jne 0x10020792
call edi
mov esi, eax
test esi, esi
je 0x1002077c
mov eax, 1
jmp 0x1002078d
call ebp
mov ebx, eax
test ebx, ebx
je 0x1002089f
mov eax, 2
mov dword [0x1002f3cc], eax
cmp eax, 1
jne 0x10020832
test esi, esi
jne 0x100207ab
call edi
mov esi, eax
test esi, esi
je 0x1002089f
cmp word [esi], 0
mov eax, esi
je 0x100207c5
add eax, 2
cmp word [eax], 0
jne 0x100207b3
add eax, 2
cmp word [eax], 0
jne 0x100207b3
sub eax, esi
push 0
sar eax, 1
inc eax
push 0
mov ebp, eax
push 0
push 0
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x10020824
push edi
call fcn.1001dba0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10020824
push 0
push 0
push edi
push ebx
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x10020816
push ebx
call fcn.1001db30
add esp, 4
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x1002089f
test ebx, ebx
jne 0x10020843
call ebp
mov ebx, eax
test ebx, ebx
je 0x1002089f
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x1002085b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1002084b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1002084b
sub eax, ebx
inc eax
mov esi, eax
push esi
call fcn.1001dba0
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x1002087d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x10020900
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x1a8
mov eax, 0x1002dac0
push ebx
push ebp
push esi
push edi
xor ebp, ebp
cmp ecx, dword [eax]
je 0x10020924
add eax, 8
inc ebp
cmp eax, 0x1002db50
jb 0x10020915
cmp ecx, dword [ebp*8 + 0x1002dac0]
jne 0x10020acb
mov eax, dword [0x1002f0e8]
cmp eax, 1
je 0x10020a8d
test eax, eax
jne 0x10020950
cmp dword [0x1002f0ec], 1
je 0x10020a8d
cmp ecx, 0xfc
je 0x10020acb
lea eax, [esp + 0xb4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1002098b
mov ecx, 5
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x100209d4
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 3
mov ebx, ecx
lea ecx, [esp + 0xb8]
sub ecx, 0x3b
push 0x10025458
add ebx, ecx
push ebx
call fcn.10021540
add esp, 0xc
mov ecx, 6
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
push 0x12010
rep movsb byte es:[edi], byte [esi]
mov edi, 0x10025438
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.Microsoft_Visual_C_Runtime_Library
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp*8 + 0x1002dac4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.100214b0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x100308e0]
test eax, eax
je 0x10020a9e
mov esi, dword [eax + 0x48]
cmp esi, 0xffffffff
jne 0x10020aa8
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebp*8 + 0x1002dac4]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
Function at 0x10020d40
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x41c
push ebx
mov ebx, dword [esp + 0x42c]
push ebp
xor ebp, ebp
push esi
cmp ebx, ebp
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x20], ebp
jne 0x10020d6c
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, dword [esp + 0x430]
mov eax, ecx
sar eax, 5
lea edi, [eax*4 + 0x100308e0]
mov eax, ecx
and eax, 0x1f
mov dword [esp + 0x24], edi
mov edx, dword [edi]
lea esi, [eax + eax*8]
shl esi, 2
mov dword [esp + 0x14], esi
test byte [esi + edx + 4], 0x20
je 0x10020da7
push 2
push ebp
push ecx
call fcn.10020c40
add esp, 0xc
mov eax, dword [edi]
add eax, esi
test byte [eax + 4], 0x80
je 0x10020f09
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x18], 0
test ebx, ebx
mov edi, ebp
jbe 0x10020e51
lea eax, [esp + 0x28]
mov ecx, edi
sub ecx, ebp
cmp ecx, ebx
jae 0x10020e02
mov cl, byte [edi]
inc edi
cmp cl, 0xa
jne 0x10020def
mov esi, dword [esp + 0x20]
mov byte [eax], 0xd
inc esi
inc eax
mov dword [esp + 0x20], esi
mov byte [eax], cl
inc eax
mov edx, eax
lea ecx, [esp + 0x28]
sub edx, ecx
cmp edx, 0x400
jl 0x10020dd2
mov esi, eax
lea edx, [esp + 0x28]
lea eax, [esp + 0x1c]
sub esi, edx
mov edx, dword [esp + 0x24]
push 0
push eax
lea ecx, [esp + 0x30]
mov eax, dword [edx]
push esi
push ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + eax]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10020efa
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
add edx, eax
cmp eax, esi
mov dword [esp + 0x10], edx
jl 0x10020e4d
mov eax, edi
sub eax, ebp
cmp eax, ebx
jb 0x10020dce
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x10020ee9
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10020ea5
cmp eax, 5
jne 0x10020e8e
call fcn.100218e0
mov dword [eax], 9
call fcn.100218f0
mov dword [eax], 5
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
push eax
call fcn.10021860
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
test byte [esi + edx + 4], 0x40
je 0x10020ec5
cmp byte [ebp], 0x1a
jne 0x10020ec5
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
call fcn.100218e0
mov dword [eax], 0x1c
call fcn.100218f0
mov dword [eax], 0
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
add esp, 0x41c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
jmp 0x10020e4d
mov edx, dword [eax]
lea ecx, [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x438]
push ecx
push ebx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10020f3a
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
jmp 0x10020e51
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
jmp 0x10020e51