joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000fed0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10045060
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push 0x10048224
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0
call fcn.10009fb0
xor esi, esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], esi
lea eax, [esp + 8]
push eax
push 0x20019
push esi
push str.CLSIDF9E2CFAA_66E4_458e_8C7F_A87AC7B7F3EE
push SysReAllocString
mov byte [esp + 0x30], 1
mov dword [esp + 0x24], 0x21
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000ffaf
mov edx, dword [esp + 4]
mov eax, dword [edx - 4]
mov esi, dword [esp + 8]
mov ecx, 1
sub ecx, eax
mov eax, dword [edx - 8]
sub eax, 0x22
or eax, ecx
mov dword [esp + 0xc], esi
jge 0x1000ff6c
push 0x22
lea ecx, [esp + 8]
call fcn.10004960
mov edx, dword [esp + 4]
lea ecx, [esp + 0x10]
push ecx
push edx
push str.CODE
lea ecx, [esp + 0x18]
call fcn.100018e0
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x1000ff8c
xor eax, eax
jmp 0x1000ff9d
push ecx
call fcn.10036536
add esp, 4
test eax, eax
jl 0x1001000d
mov ecx, dword [esp + 4]
cmp eax, dword [ecx - 8]
jg 0x1001000d
mov dword [ecx - 0xc], eax
mov edx, dword [esp + 4]
mov word [edx + eax*2], 0
mov eax, dword [esp + 4]
add eax, 0xfffffff0
push edi
push eax
call fcn.10004390
mov edi, dword [esp + 0x2c]
add eax, 0x10
add esp, 4
test esi, esi
mov dword [edi], eax
je 0x1000ffd4
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000fffa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
push 0x80070057
call fcn.10003290
int3
Function at 0x10012fc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10045320
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], ebx
cmp byte [esi + 8], bl
jne 0x10013007
mov eax, dword [esp + 0x48]
pop esi
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
pop ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret 4
push edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov eax, dword [esi]
mov eax, dword [eax + 8]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x48], ebx
call fcn.10012720
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov edi, dword [ecx + 4]
cmp eax, edi
mov dword [esp + 0xc], eax
je 0x100130b1
push ebp
mov ebp, 0xf
nop
mov esi, dword [eax + 0x10]
mov eax, esi
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10013054
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x2c]
call fcn.10006870
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x4c], 1
call fcn.10012ea0
cmp dword [esp + 0x3c], 0x10
mov byte [esp + 0x48], bl
jb 0x10013093
mov edx, dword [esp + 0x28]
push edx
call fcn.100363ae
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.100111d0
mov eax, dword [esp + 0x10]
cmp eax, edi
jne 0x10013040
pop ebp
mov edi, dword [esp + 0x4c]
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.10012610
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x100130e7
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
push esi
call fcn.10012340
push esi
call fcn.100363ae
add esp, 0x14
mov ecx, dword [esp + 0x3c]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret 4

Function at 0x10014ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100454d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
mov eax, dword [esi + 0x50]
push 0x20
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.100148d0
push 0xffffffffffffffff
push 0
lea eax, [esp + 0xc]
push eax
lea ecx, [esi + 0x30]
mov dword [esp + 0x34], 0
call fcn.10010870
cmp dword [esp + 0x1c], 0x10
pop esi
jb 0x10014f5d
mov ecx, dword [esp + 4]
push ecx
call fcn.100363ae
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x100235e0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x100533e8]
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0x198]
mov dword [eax + 0x191b4], 1
mov eax, dword [0x10054998]
test eax, eax
jne 0x1002363f
lea ecx, [esp]
push ecx
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10023635
or eax, 0xffffffff
mov ecx, dword [esp + 0x190]
call fcn.10036133
add esp, 0x194
ret
mov dword [0x10054998], 1
mov ecx, dword [esp + 0x190]
xor eax, eax
call fcn.10036133
add esp, 0x194
ret

Function at 0x100236c0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x324
mov ecx, dword [esp + 0x328]
xor edx, edx
mov dword [ecx + 0x191b8], edx
mov ecx, dword [esp + 0x330]
cmp ecx, edx
mov dword [esp], edx
jle 0x100236e7
dec ecx
mov dword [esp], ecx
push ebx
mov ecx, eax
mov edx, eax
push ebp
and ecx, 1
and edx, 2
push esi
and eax, 4
push edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
jmp 0x10023712
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x33c]
xor ebp, ebp
xor ebx, ebx
xor edi, edi
test ecx, ecx
mov ecx, 1
je 0x10023734
lea edi, [esp + 0x28]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ecx
test edx, edx
je 0x1002374d
lea ebx, [esp + 0x12c]
mov dword [esp + 0x130], esi
mov dword [esp + 0x12c], ecx
test eax, eax
je 0x10023766
lea ebp, [esp + 0x230]
mov dword [esp + 0x234], esi
mov dword [esp + 0x230], ecx
mov ecx, dword [esp + 0x340]
test ecx, ecx
jg 0x10023798
mov eax, 0xbce4217d
imul ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x20], eax
mov eax, ecx
neg eax
cdq
mov ecx, 0xf4240
idiv ecx
mov dword [esp + 0x24], edx
jmp 0x100237a8
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0
lea edx, [esp + 0x20]
push edx
push ebp
push ebx
push edi
lea eax, [esi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
jge 0x100237d5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [esp + 0x338]
mov dword [ecx + 0x191b8], eax
test esi, esi
jne 0x100237f7
mov eax, dword [esp + 0x10]
mov edx, eax
dec eax
test edx, edx
mov dword [esp + 0x10], eax
jne 0x10023706
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x324
ret
test esi, esi
jle 0x10023851
mov eax, dword [esp + 0x1c]
xor esi, esi
test eax, eax
je 0x1002381e
push edi
mov edi, dword [esp + 0x340]
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x10023825
mov esi, 1
jmp 0x10023825
mov edi, dword [esp + 0x33c]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1002383b
push ebx
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1002383b
or esi, 2
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10023851
push ebp
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x10023851
or esi, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x324
ret
Function at 0x10025c30
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 0xc]
test ecx, ecx
push ebx
mov ebx, dword [esp + 0x14]
jne 0x10025c6b
lea ecx, [ebx + 2]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 8]
lea ecx, [eax*4 + 1]
push ecx
push edx
call fcn.10024190
mov ecx, eax
add esp, 8
test ecx, ecx
jne 0x10025c6b
pop ebx
ret
push edi
mov edi, dword [esp + 0x10]
test edi, edi
mov dword [esp + 0x14], ecx
mov byte [ecx], 0
jne 0x10025c80
pop edi
mov eax, ecx
pop ebx
ret
cmp ebx, 2
push ebp
push esi
jle 0x10025cdf
lea edx, [ebx - 3]
mov eax, 0xaaaaaaab
mul edx
mov ebp, edx
shr ebp, 1
inc ebp
mov eax, ebp
imul eax, eax, 0xfffffffd
add ebx, eax
lea ecx, [ecx]
movzx eax, byte [edi + 2]
xor edx, edx
mov dh, byte [edi]
mov dl, byte [edi + 1]
shl edx, 8
or edx, eax
mov esi, edx
mov eax, 4
jmp 0x10025cc0
mov edx, esi
and edx, 0x3f
mov dl, byte [edx + 0x10049720]
dec eax
shr esi, 6
test eax, eax
mov byte [eax + ecx], dl
jg 0x10025cc0
add ecx, 4
add edi, 3
dec ebp
jne 0x10025ca0
test ebx, ebx
mov byte [ecx], 0
jle 0x10025d4d
xor eax, eax
xor esi, esi
test ebx, ebx
jle 0x10025d03
mov edx, ebx
mov esi, ebx
movzx ebp, byte [edi]
shl eax, 8
or eax, ebp
inc edi
dec edx
jne 0x10025cf2
cmp ebx, 3
jge 0x10025d16
mov edx, 3
sub edx, esi
lea ebx, [ebx]
shl eax, 8
dec edx
jne 0x10025d10
mov esi, 4
jmp 0x10025d20
mov edx, eax
and edx, 0x3f
mov dl, byte [edx + 0x10049720]
dec esi
shr eax, 6
test esi, esi
mov byte [esi + ecx], dl
jg 0x10025d20
mov eax, 3
cmp ebx, eax
jge 0x10025d49
nop
mov byte [eax + ecx], 0x3d
dec eax
cmp eax, ebx
jg 0x10025d40
mov byte [ecx + 4], 0
mov eax, dword [esp + 0x1c]
pop esi
pop ebp
pop edi
pop ebx
ret
Function at 0x100330b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x100459aa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov eax, dword [esi + 0x58]
mov ecx, dword [eax]
lea edi, [esi + 0x54]
push eax
push ecx
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov dword [esp + 0x28], 6
call fcn.10032d00
mov eax, dword [edi + 4]
push eax
call fcn.100363ae
xor ebx, ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x4c]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x48]
push eax
push ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov byte [esp + 0x28], 5
call fcn.10032d00
mov eax, dword [edi + 4]
push eax
call fcn.100363ae
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x40]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x3c]
push eax
push ecx
lea edx, [esp + 0x18]
push edx
mov ecx, edi
mov byte [esp + 0x28], 4
call fcn.10032d00
mov eax, dword [edi + 4]
push eax
call fcn.100363ae
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x34]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x30]
push eax
push ecx
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov byte [esp + 0x28], 3
call fcn.10032d00
mov eax, dword [edi + 4]
push eax
call fcn.100363ae
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x28]
mov ecx, dword [eax]
lea edi, [esi + 0x24]
add esp, 4
mov byte [esp + 0x1c], 2
push eax
push ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
call fcn.10032d00
mov eax, dword [edi + 4]
push eax
call fcn.100363ae
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x18]
push eax
push ecx
lea edx, [esp + 0x18]
push edx
mov ecx, edi
mov byte [esp + 0x28], 1
call fcn.10032d00
mov eax, dword [edi + 4]
push eax
call fcn.100363ae
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0xc]
push eax
push ecx
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov byte [esp + 0x28], bl
call fcn.10032d00
mov eax, dword [edi + 4]
push eax
call fcn.100363ae
add esp, 4
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 4]
mov ecx, dword [eax]
push eax
push ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
mov dword [esp + 0x28], 0xffffffff
call fcn.10032d00
mov edx, dword [esi + 4]
push edx
call fcn.100363ae
mov ecx, dword [esp + 0x18]
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10036875
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.100365e0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10036910
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x10054ba8]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x10036910
cmp eax, 1
je 0x10036931
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10036910
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x100368dd
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x1003690c
xor eax, eax
inc eax
jmp 0x10036950
cmp edi, eax
jae 0x10036914
xor eax, eax
jmp 0x10036950
cmp eax, esi
jae 0x1003691b
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x10054ba8]
jmp 0x10036934
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10037735
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x10037752
call fcn.1003cc0b
mov dword [eax], 0x16
xor eax, eax
jmp 0x100377bc
push esi
push 0x8c
push 1
call fcn.1003cc90
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x100377a7
push esi
call fcn.1003abf9
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x10037785
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x100376a0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x100377bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.1003633d
test ebx, ebx
pop ecx
je 0x100377b9
push ebx
call fcn.1003cc1d
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100386bf
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x100533e8]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x100386f0
xor eax, eax
jmp 0x10038879
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x100552a0]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x1003872c
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.1003e78c
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x10038807
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x10038845
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x10038790
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x10038781
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x10038761
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100387d0
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x100387d9
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x10038752
jmp 0x100387db
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x10038874
cmp dword [ebp - 0x6c], edi
je 0x10038845
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x1003883a
call fcn.1003cc0b
mov dword [eax], 9
call fcn.1003cc14
mov dword [eax], esi
jmp 0x1003886f
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1003882f
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x100387db
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x100387db
push dword [ebp - 0x6c]
call fcn.1003cc1d
pop ecx
jmp 0x1003886f
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x1003885d
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x1003885d
xor eax, eax
jmp 0x10038877
call fcn.1003cc0b
mov dword [eax], 0x1c
call fcn.1003cc14
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x10038877
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.10036133
add ebp, 0x3a0
leave
ret
Function at 0x10038938
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x10038b0c
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x100552a0]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x10038b0c
test cl, 0x48
je 0x100389a3
cmp byte [eax + 5], 0xa
je 0x100389a3
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100389f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x100389dd
call fcn.1003cc0b
mov dword [eax], 9
call fcn.1003cc14
mov dword [eax], esi
jmp 0x100389ed
cmp eax, 0x6d
je 0x10038b0c
push eax
call fcn.1003cc1d
pop ecx
or eax, 0xffffffff
jmp 0x10038b0e
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x10038b07
test eax, eax
je 0x10038a1c
cmp byte [ebx], 0xa
jne 0x10038a1c
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x10038a25
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x10038b01
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x10038af1
cmp al, 0xd
je 0x10038a57
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x10038ae3
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x10038a71
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x10038a6c
add dword [ebp + 0x10], 2
jmp 0x10038ac5
mov dword [ebp + 0x10], eax
jmp 0x10038adf
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10038a99
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10038adf
cmp dword [ebp - 0xc], 0
je 0x10038adf
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x10038aba
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x10038ac5
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x10038ae2
cmp ebx, dword [ebp + 0xc]
jne 0x10038aca
cmp byte [ebp - 1], 0xa
jne 0x10038aca
mov byte [ebx], 0xa
jmp 0x10038ae2
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1003e80f
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x10038ae3
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x10038a3b
jmp 0x10038b01
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x10038b01
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x10038b0e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10038bbe
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x10038cae
mov eax, 0x94
call fcn.100365e0
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10038d23
mov ecx, dword [esi + 0x10]
mov dword [0x10054ba8], ecx
mov eax, dword [esi + 4]
mov dword [0x10054bb4], eax
mov edx, dword [esi + 8]
mov dword [0x10054bb8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x10054bac], esi
je 0x10038c29
or esi, 0x8000
mov dword [0x10054bac], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x10054bb0], eax
call fcn.10039293
test eax, eax
pop ecx
je 0x10038d23
call fcn.1003adf3
test eax, eax
jne 0x10038c56
call fcn.100392e4
jmp 0x10038d23
call fcn.1003ed25
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10056400], eax
call fcn.1003ec03
mov dword [0x100549d4], eax
call fcn.1003e3c0
test eax, eax
jl 0x10038ca7
call fcn.1003eb61
test eax, eax
jl 0x10038ca2
call fcn.1003e92e
test eax, eax
jl 0x10038ca2
push 0
call fcn.1003af3c
test eax, eax
pop ecx
jne 0x10038ca2
inc dword [0x100549d0]
jmp 0x10038d34
call fcn.1003e5be
call fcn.1003abdc
jmp 0x10038c4c
test eax, eax
jne 0x10038cde
cmp dword [0x100549d0], eax
jle 0x10038d23
dec dword [0x100549d0]
cmp dword [0x10054be4], eax
jne 0x10038ccd
call fcn.1003b07a
call fcn.1003e5be
call fcn.1003abdc
call fcn.100392e4
jmp 0x10038d34
cmp eax, 2
jne 0x10038d27
push 0x8c
push 1
call fcn.1003cc90
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10038d23
push esi
push dword [0x10053860]
call dword [0x10054b9c]
test eax, eax
push esi
je 0x10038d1d
call fcn.1003abf9
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x10038d34
call fcn.1003633d
pop ecx
xor eax, eax
jmp 0x10038d37
cmp eax, 3
jne 0x10038d34
push 0
call fcn.1003adc4
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc