joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008de4
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
xor edi, edi
cmp dword [0x1020228], edi
jne 0x1008ee2
cmp dword [0x1020224], edi
jne 0x1008ee2
cmp dword [0x1020230], edi
je 0x1008ed1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x1020248], edi
mov esi, eax
je 0x1008e39
push esi
push dword [0x102024c]
call fcn.01008eee
cmp eax, dword [0x1020248]
jb 0x1008ed1
mov eax, dword [0x101b460]
cmp eax, 0xffffffff
je 0x1008e55
push esi
push eax
call fcn.01008eee
cmp eax, 0xc8
jb 0x1008edb
mov ebx, dword [esp + 0x30]
push 1
pop eax
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push 0x404
push ebx
mov dword [0x1020228], eax
call edi
mov ebp, dword [sym.imp.USER32.dll_PeekMessageA]
mov esi, 0x113
push 3
push esi
push esi
lea eax, [esp + 0x1c]
push ebx
push eax
call ebp
push 3
push esi
push esi
lea eax, [esp + 0x1c]
push ebx
push eax
call ebp
xor esi, esi
push esi
push esi
push 0x8000
push ebx
call edi
push esi
push esi
push 0x404
push ebx
mov dword [0x1020224], eax
mov dword [0x1020228], esi
call edi
cmp dword [0x1020224], esi
jne 0x1008ec4
push esi
call dword [sym.imp.USER32.dll_SetCursor]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101b460], eax
jmp 0x1008edb
mov dword [0x1020224], 1
mov eax, dword [0x1020224]
jmp 0x1008ee4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x10096a4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [0x10207b0], 1
lea eax, [edi + 4]
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x368]
push eax
call ebx
xor esi, esi
cmp dword [edi], esi
je 0x10096f6
push dword [ebp - 4]
lea eax, [ebp - 0x15c]
push eax
call ebx
mov eax, dword [edi]
and byte [ebp + eax - 0x15d], 0
lea eax, [edi + eax + 4]
push eax
jmp 0x1009750
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x15c]
push eax
push 0x104
push esi
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
je 0x100973b
lea eax, [ebp - 0x15c]
push eax
push dword [ebp - 4]
call ebx
mov eax, dword [ebp - 8]
push dword [ebp - 8]
lea ecx, [ebp - 0x15c]
sub eax, ecx
mov dword [edi], eax
and byte [ebp + eax - 0x15d], 0
jmp 0x1009750
lea eax, [ebp - 0x15c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push dword [ebp - 4]
lea eax, [ebp - 0x260]
push eax
call ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x58], 0x4c
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x260]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x15c]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], 0x10206a8
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x38], 0x104
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0x1020668
mov dword [ebp - 0x24], 0x1804
mov word [ebp - 0x20], si
mov word [ebp - 0x1e], si
mov dword [ebp - 0x1c], 0x1020728
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
lea eax, [ebp - 0x58]
mov dword [ebp + 8], esi
push eax
call sub.comdlg32.dll_GetOpenFileNameA
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x1009808
movzx eax, word [ebp - 0x20]
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x264]
push eax
call fcn.01009935
test eax, eax
je 0x1009801
push 0x42
lea esi, [ebp - 0x264]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 0xc]
xor esi, esi
jmp 0x1009808
mov dword [ebp + 8], 1
cmp dword [ebp + 8], esi
je 0x1009849
cmp word [ebp - 0x20], si
je 0x1009840
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x15c]
push eax
call ebx
movzx eax, word [ebp - 0x20]
and byte [ebp + eax - 0x15d], 0
lea eax, [ebp + eax - 0x260]
push eax
lea eax, [ebp - 0x260]
push eax
call ebx
cmp dword [ebp + 8], esi
jne 0x10097c2
cmp dword [ebp - 0xc], esi
mov dword [0x10207b0], esi
je 0x100986d
push dword [ebp - 4]
lea eax, [ebp - 0x368]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100986d
push 1
pop eax
jmp 0x100986f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1009876
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], 0x104
call fcn.0100a352
test eax, eax
je 0x1009896
push 0x1001990
jmp 0x1009927
lea eax, [ebp - 8]
xor esi, esi
push eax
push 1
push esi
push 0x1001960
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1009905
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push esi
push esi
push 0x1001954
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov esi, 0x1001948
jne 0x10098f0
mov eax, dword [ebp - 4]
add eax, 4
cmp eax, 0x104
ja 0x10098f0
push 0x1020768
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x10098fa
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1009914
mov esi, 0x1001948
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1009930
push 0x1001938
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop esi
leave
ret 4

Function at 0x100b7b7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x90
push 0x40
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x100b866
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x6c], eax
je 0x100b836
lea ecx, [ebp - 4]
push 0
push ecx
push 0xc
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ax, word [esi]
cmp ax, 0xda01
jne 0x100b82d
mov ax, word [esi + 6]
xor ecx, ecx
mov cl, ah
mov ch, al
mov ax, word [esi + 8]
mov word [esi + 6], cx
xor ecx, ecx
mov ch, al
mov cl, ah
mov word [esi + 8], cx
jmp 0x100b833
cmp ax, 0x1da
jne 0x100b836
push 1
pop ebx
test ebx, ebx
je 0x100b84e
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x100b84e
movzx ecx, word [esi + 6]
mov dword [eax], ecx
movzx ecx, word [esi + 8]
mov dword [eax + 4], ecx
mov eax, dword [esi + 0x6c]
cmp eax, 0xffffffff
je 0x100b85d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
pop esi
pop ebx
leave
ret 8
Function at 0x100bc91
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push edi
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x100bd49
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov dword [ebp - 4], eax
je 0x100bd49
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, esi
je 0x100bd54
cmp word [edi], 0x4d42
lea eax, [edi + 0xe]
je 0x100bcf4
mov eax, edi
movzx ecx, word [eax + 2]
movzx edx, word [eax]
shl ecx, 0x10
or ecx, edx
cmp ecx, 0xc
je 0x100bd32
cmp ecx, 0x28
jne 0x100bd49
mov ecx, dword [ebp + 0xc]
cmp ecx, esi
je 0x100bd46
movzx edx, word [eax + 6]
movzx ebx, word [eax + 4]
shl edx, 0x10
or edx, ebx
mov dword [ecx], edx
movzx edx, word [eax + 0xa]
movzx eax, word [eax + 8]
shl edx, 0x10
or edx, eax
mov dword [ecx + 4], edx
jmp 0x100bd46
mov ecx, dword [ebp + 0xc]
cmp ecx, esi
je 0x100bd46
movzx edx, word [eax + 4]
mov dword [ecx], edx
movzx eax, word [eax + 6]
mov dword [ecx + 4], eax
push 1
pop ebx
cmp edi, esi
je 0x100bd54
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 4], esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x100bd64
push dword [ebp - 4]
call esi
cmp dword [ebp + 8], 0xffffffff
je 0x100bd6f
push dword [ebp + 8]
call esi
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 8

Function at 0x100d3eb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
lea eax, [ebp - 4]
push edi
xor esi, esi
and dword [ebp - 4], esi
push eax
push 1
push esi
push 0x1001be0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100d48d
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x100d48a
mov esi, dword [ebp + 8]
mov edi, 0x101b590
sub edi, esi
mov dword [ebp + 0xc], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x40
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [edi + esi]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100d482
cmp dword [ebp - 0xc], 1
jne 0x100d482
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push 0x1001bd4
push eax
call fcn.0100e4c0
movzx ecx, byte [ebp - 0x14]
xor eax, eax
add esp, 0x14
mov ah, byte [ebp + 8]
mov al, byte [ebp - 0x10]
shl eax, 8
or eax, ecx
mov dword [esi], eax
add esi, 4
dec dword [ebp + 0xc]
jne 0x100d427
push 1
pop esi
cmp dword [ebp - 4], 0
je 0x100d49c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
leave
ret 8
Function at 0x100d9f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001c10
push 0x100e154
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x1020a0c], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x1020a08], ecx
shl ecx, 8
add ecx, edx
mov dword [0x1020a04], ecx
shr eax, 0x10
mov dword [0x1020a00], eax
call fcn.0100f3d0
test eax, eax
jne 0x100da5a
push 0x1c
call fcn.0100db40
add esp, 4
mov dword [ebp - 4], 0
call fcn.0100f1d0
call fcn.0100f1c0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10223f0], eax
call fcn.0100eb80
mov dword [0x10209e0], eax
test eax, eax
je 0x100da8d
mov eax, dword [0x10223f0]
test eax, eax
jne 0x100da97
push 0xffffffffffffffff
call fcn.0100e540
add esp, 4
call fcn.0100e8d0
call fcn.0100e7e0
call fcn.0100e510
mov eax, dword [0x1020a1c]
mov dword [0x1020a20], eax
push eax
mov eax, dword [0x1020a14]
push eax
mov ecx, dword [0x1020a10]
push ecx
call fcn.01008f89
add esp, 0xc
mov dword [ebp - 0x1c], eax
push eax
call fcn.0100e540
jmp 0x100daf2
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100db40
Capabilities:
Terminate process

Disassembly:
cmp dword [0x10209e8], 2
je 0x100db4e
call fcn.0100f410
mov eax, dword [esp + 4]
push eax
call fcn.0100f450
add esp, 4
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100e580
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1020a3c]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
cmp eax, 1
push esi
jne 0x100e59f
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x1020a38], 1
mov byte [0x1020a34], bl
jne 0x100e5f9
mov ecx, dword [0x10223ec]
test ecx, ecx
je 0x100e5e7
mov esi, dword [0x10223e8]
sub esi, 4
cmp esi, ecx
jb 0x100e5e7
mov eax, dword [esi]
test eax, eax
je 0x100e5e0
call eax
mov ecx, dword [0x10223ec]
sub esi, 4
cmp esi, ecx
jae 0x100e5d2
push 0x101b01c
push 0x101b014
call fcn.0100e630
add esp, 8
push 0x101b024
push 0x101b020
call fcn.0100e630
add esp, 8
test ebx, ebx
jne 0x100e620
push ebp
mov dword [0x1020a3c], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebp
pop ebx
ret
Function at 0x100eb80
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x1020b50]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
xor esi, esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
jne 0x100ebc2
call edi
mov esi, eax
test esi, esi
je 0x100ebac
mov eax, 1
jmp 0x100ebbd
call ebp
mov ebx, eax
test ebx, ebx
je 0x100eccf
mov eax, 2
mov dword [0x1020b50], eax
cmp eax, 1
jne 0x100ec62
test esi, esi
jne 0x100ebdb
call edi
mov esi, eax
test esi, esi
je 0x100eccf
cmp word [esi], 0
mov eax, esi
je 0x100ebf5
add eax, 2
cmp word [eax], 0
jne 0x100ebe3
add eax, 2
cmp word [eax], 0
jne 0x100ebe3
sub eax, esi
push 0
sar eax, 1
inc eax
push 0
mov ebp, eax
push 0
push 0
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x100ec54
push edi
call fcn.0100db70
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x100ec54
push 0
push 0
push edi
push ebx
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x100ec46
push ebx
call fcn.0100dc20
add esp, 4
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x100eccf
test ebx, ebx
jne 0x100ec73
call ebp
mov ebx, eax
test ebx, ebx
je 0x100eccf
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x100ec8b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x100ec7b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x100ec7b
sub eax, ebx
inc eax
mov esi, eax
push esi
call fcn.0100db70
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x100ecad
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x100f450
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x1a8
mov eax, 0x101b8b0
push ebx
push ebp
push esi
push edi
xor ebp, ebp
cmp ecx, dword [eax]
je 0x100f474
add eax, 8
inc ebp
cmp eax, 0x101b940
jb 0x100f465
cmp ecx, dword [ebp*8 + 0x101b8b0]
jne 0x100f61b
mov eax, dword [0x10209e8]
cmp eax, 1
je 0x100f5dd
test eax, eax
jne 0x100f4a0
cmp dword [0x101b6b8], 1
je 0x100f5dd
cmp ecx, 0xfc
je 0x100f61b
lea eax, [esp + 0xb4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100f4db
mov ecx, 5
mov esi, 0x1001f00
lea edi, [esp + 0xb4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x100f524
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 3
mov ebx, ecx
lea ecx, [esp + 0xb8]
sub ecx, 0x3b
push 0x1001efc
add ebx, ecx
push ebx
call fcn.010136d0
add esp, 0xc
mov ecx, 6
mov esi, 0x1001ee0
lea edi, [esp + 0x14]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
push 0x12010
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1001edc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1001eb4
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp*8 + 0x101b8b4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.01013640
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x10222e0]
test eax, eax
je 0x100f5ee
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x100f5f8
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebp*8 + 0x101b8b4]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
Function at 0x10175d0
Capabilities:
Set environment variable

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x101778e
push 0x3d
push edi
call fcn.01017c80
mov esi, eax
add esp, 8
test esi, esi
je 0x101778e
cmp edi, esi
je 0x101778e
mov dl, byte [esi + 1]
mov ecx, dword [0x1020a20]
xor eax, eax
test dl, dl
sete al
mov ebp, eax
mov eax, dword [0x1020a1c]
cmp eax, ecx
jne 0x1017627
push eax
call fcn.01017860
add esp, 4
mov dword [0x1020a1c], eax
test eax, eax
jne 0x10176a2
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x101764e
mov eax, dword [0x1020a24]
test eax, eax
je 0x101764e
call fcn.01016c70
test eax, eax
je 0x101769d
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
test ebp, ebp
je 0x101765a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 4
call fcn.0100db70
add esp, 4
mov dword [0x1020a1c], eax
test eax, eax
je 0x101778e
mov dword [eax], 0
mov eax, dword [0x1020a24]
test eax, eax
jne 0x101769d
push 4
call fcn.0100db70
add esp, 4
mov dword [0x1020a24], eax
test eax, eax
je 0x101778e
mov dword [eax], 0
mov eax, dword [0x1020a1c]
mov ebx, eax
mov eax, esi
sub eax, edi
push eax
push edi
mov dword [esp + 0x18], eax
call fcn.010177e0
mov esi, eax
add esp, 8
test esi, esi
jl 0x101779f
cmp dword [ebx], 0
je 0x101779f
test ebp, ebp
je 0x1017797
mov ecx, dword [ebx + esi*4]
lea edi, [ebx + esi*4]
push ecx
call fcn.0100dc20
mov eax, dword [edi]
add esp, 4
test eax, eax
je 0x10176f9
mov eax, edi
mov edx, dword [eax + 4]
add eax, 4
mov dword [edi], edx
inc esi
mov ecx, dword [eax]
mov edi, eax
test ecx, ecx
jne 0x10176e8
lea eax, [esi*4]
push eax
push ebx
call fcn.01017ae0
add esp, 8
test eax, eax
je 0x1017713
mov dword [0x1020a1c], eax
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1017786
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
push ecx
call fcn.0100db70
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1017786
mov edi, dword [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x10]
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
neg ebp
rep movsb byte es:[edi], byte [esi]
sbb ebp, ebp
mov byte [ebx + eax], 0
lea eax, [ebx + eax + 1]
not ebp
and ebp, eax
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
call fcn.0100dc20
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov dword [ebx + esi*4], edi
jmp 0x1017717
test ebp, ebp
jne 0x1017786
test esi, esi
jge 0x10177a9
neg esi
lea ecx, [esi*4 + 8]
push ecx
push ebx
call fcn.01017ae0
add esp, 8
test eax, eax
je 0x101778e
mov dword [eax + esi*4], edi
mov dword [eax + esi*4 + 4], 0
mov dword [0x1020a1c], eax
jmp 0x1017717
Function at 0x1018c95
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ax, word [esi + 2]
and ax, 0xff00
cmp ax, 0x100
jne 0x1018d44
movzx eax, word [esi + 8]
mov edi, dword [ebp + 0x14]
xor ebx, ebx
mov ecx, edi
push ebx
imul ecx, eax
add ecx, dword [ebp + 0x10]
mov eax, dword [esi + 0x84]
push ebx
push dword [eax + ecx*4]
push dword [esi + 0x6c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 8]
push ebx
push eax
movzx eax, word [esi + 8]
imul edi, eax
add edi, dword [ebp + 0x10]
mov eax, dword [esi + 0x88]
push dword [eax + edi*4]
push dword [esi + 0x70]
push dword [esi + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, dword [esi + 0x70]
mov edi, dword [ebp + 0xc]
mov al, byte [esi]
inc esi
mov cl, al
mov dword [ebp + 0x10], edi
and ecx, 0x7f
je 0x1018d7f
test al, 0x80
je 0x1018d1d
lea eax, [ecx]
mov cl, byte [esi]
mov byte [edi], cl
inc edi
inc esi
dec eax
jne 0x1018d12
jmp 0x1018cff
mov al, byte [esi]
mov dword [ebp + 0x14], ecx
mov bl, al
mov edx, ecx
mov bh, bl
inc esi
mov eax, ebx
shl eax, 0x10
mov ax, bx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [ebp + 0x10]
add edi, edx
jmp 0x1018cff
movzx eax, word [esi + 8]
imul eax, dword [ebp + 0x14]
movzx ecx, word [esi + 6]
add eax, dword [ebp + 0x10]
xor ebx, ebx
push ebx
push ebx
imul eax, ecx
add eax, 0x200
push eax
push dword [esi + 0x6c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 8]
push ebx
push eax
movzx eax, word [esi + 6]
push eax
push dword [ebp + 0xc]
push dword [esi + 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x10001000
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x10003018]
sub esp, 0x14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100048a0
push eax
call esi
mov ecx, dword [0x10003630]
push 0x10004890
push ecx
mov dword [0x10003420], eax
call esi
mov edx, dword [0x10003630]
push 0x1000487c
push edx
mov dword [0x1000362c], eax
call esi
mov dword [0x10003004], eax
mov eax, dword [0x10003630]
push 0x10004870
push eax
call esi
mov ecx, dword [0x10003420]
mov dword [0x10003628], eax
test ecx, ecx
je 0x100011cd
mov ecx, dword [0x1000362c]
test ecx, ecx
je 0x100011cd
mov ecx, dword [0x10003004]
test ecx, ecx
je 0x100011cd
test eax, eax
je 0x100011cd
mov ecx, dword [0x10003018]
push 0x10004858
push ecx
call esi
test eax, eax
jne 0x100010af
push eax
push 0x10003008
push 0x27
push eax
call dword [0x10003420]
test eax, eax
jne 0x100011c5
lea edx, [esp + 8]
push edx
push 0x20019
push 0
push 0x100047d8
push 0x80000001
call dword [0x1000362c]
lea eax, [esp + 4]
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push edx
push 0
mov esi, 4
push 0x10004818
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], esi
call dword [0x10003004]
mov eax, dword [esp + 8]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push 0x10003020
push edx
push 0
push 0x10004838
push eax
mov dword [esp + 0x1c], 0x400
call dword [0x10003004]
mov eax, dword [esp + 8]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push 0x10003428
push edx
push 0
push 0x10004828
push eax
mov dword [esp + 0x1c], 0x200
call dword [0x10003004]
lea ecx, [esp + 4]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0x10004848
push ecx
mov dword [esp + 0x1c], esi
call dword [0x10003004]
mov edx, dword [esp + 8]
push edx
call dword [0x10003628]
mov eax, dword [esp + 0x10]
push 0xc
neg eax
sbb eax, eax
push 0x10003008
and eax, 2
push 0x26
inc eax
push 0
mov dword [0x10003008], eax
mov dword [0x1000300c], 0x10003428
mov dword [0x10003010], 0x10003020
mov dword [esp + 0x14], 0xc
call dword [0x10003420]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
add esp, 0x14
ret