joyce8/EMBER2024-capa huggingface dataset:
Function at 0x577590
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5bc88b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push 0x71cc6c
lea ecx, [esp + 0x18]
call fcn.0056c110
mov edi, dword [esp + 0x130]
cmp byte [edi], 0
mov dword [esp + 0x128], 0
je 0x577603
cmp byte [edi + 0x104], 0
je 0x577603
cmp byte [edi + 0x105], 0xff
je 0x577603
or eax, 0xffffffff
cmp dword [edi + 0x106], eax
je 0x577603
cmp dword [edi + 0x10a], eax
je 0x577603
cmp dword [edi + 0x10e], eax
jne 0x57761c
push 0
push 0x1b8
push str..SourceFileSystem_r3dFileSystem.cpp
push str.fe.IsValid__
call fcn.005696c0
add esp, 0x10
mov ebx, dword [esp + 0x138]
cmp dword [edi + 0x10e], ebx
je 0x577644
push 0
push 0x1b9
push str..SourceFileSystem_r3dFileSystem.cpp
push str.fe.csize__csize
call fcn.005696c0
add esp, 0x10
movzx eax, byte [edi + 0x105]
mov esi, dword [ebp + eax*4 + 0x340]
cmp esi, 0xffffffff
jne 0x5776c7
inc eax
push eax
lea eax, [esp + 0x20]
push eax
mov ecx, ebp
call fcn.00577280
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5776b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x20]
push edx
push str.cant_open__s_for_writing___d_n
call fcn.00569580
add esp, 0xc
lea ecx, [esp + 0x14]
mov dword [esp + 0x128], esi
call fcn.0056c180
xor al, al
jmp 0x577775
movzx eax, byte [edi + 0x105]
mov dword [ebp + eax*4 + 0x340], esi
mov ecx, dword [edi + 0x106]
push 0
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [edi + 0x106]
je 0x5776f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetFilePointer_failed__d
call fcn.00569580
add esp, 8
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [esp + 0x14]
push edx
push 4
lea eax, [esp + 0x24]
push eax
push esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 0x64667261
call ebp
test eax, eax
jne 0x577734
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WriteFile_failed__d
call fcn.00569580
add esp, 8
mov edx, dword [esp + 0x134]
push 0
lea ecx, [esp + 0x14]
push ecx
push ebx
push edx
push esi
call ebp
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x57775f
push ebx
push eax
push edi
push str.failed_to_write__s__d_vs__d_n
call fcn.00569580
add esp, 0x10
lea ecx, [esp + 0x14]
mov dword [esp + 0x128], 0xffffffff
call fcn.0056c180
mov al, 1
mov ecx, dword [esp + 0x120]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x11c
ret 0xc
Function at 0x577c00
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, dword [edi + 0x10e]
add esi, 4
lea eax, [esi + 1]
push 1
push eax
mov ebp, ecx
call fcn.0056b270
movzx ecx, byte [edi + 0x105]
mov ebx, dword [ebp + ecx*4 + 0x340]
add esp, 8
mov dword [esp + 0x1c], eax
cmp ebx, 0xffffffff
jne 0x577c54
push 0
push 0x31e
push str..SourceFileSystem_r3dFileSystem.cpp
push str.h___INVALID_HANDLE_VALUE
call fcn.005696c0
add esp, 0x10
mov edx, dword [edi + 0x106]
push 0
push 0
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x14]
push eax
push esi
push ecx
push ebx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x10], esi
je 0x577cb2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RelocateFile_read_failed__d_n
call fcn.005693b0
mov edx, dword [esp + 0x24]
push edx
call fcn.0056b2b0
add esp, 0xc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0xc
mov al, byte [esp + 0x20]
mov ecx, dword [esp + 0x24]
movzx edx, al
mov byte [edi + 0x105], al
mov dword [edi + 0x106], ecx
mov ebx, dword [ebp + edx*4 + 0x340]
cmp ebx, 0xffffffff
jne 0x577cee
push 0
push 0x32f
push str..SourceFileSystem_r3dFileSystem.cpp
push str.h___INVALID_HANDLE_VALUE
call fcn.005696c0
add esp, 0x10
mov eax, dword [edi + 0x106]
push 0
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [esp + 0x1c]
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
push edi
push ebx
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x14], esi
je 0x577d48
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RelocateFile_write_failed__d_n
call fcn.005693b0
push edi
call fcn.0056b2b0
add esp, 0xc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0xc
push edi
call fcn.0056b2b0
add esp, 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret 0xc
Function at 0x577e20
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5bc8c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov ebx, ecx
push 0x71cc6c
lea ecx, [esp + 0x2c]
call fcn.0056c110
mov eax, dword [ebx + 0x14]
sub eax, dword [ebx + 0x10]
xor ebp, ebp
sar eax, 2
mov dword [esp + 0x4c], ebp
test eax, eax
ja 0x577e77
push ebp
push 0xf8
push str..SourceFileSystem_r3dFileSystem.cpp
push str.IsValid__
call fcn.005696c0
add esp, 0x10
cmp dword [esp + 0x54], ebp
jne 0x577e95
push ebp
push 0xf9
push str..SourceFileSystem_r3dFileSystem.cpp
push 0x641288
call fcn.005696c0
add esp, 0x10
mov esi, dword [ebx + 0x14]
sub esi, dword [ebx + 0x10]
push 1
sar esi, 2
imul esi, esi, 0x128
lea ecx, [esi + 1]
push ecx
mov dword [esp + 0x34], 0x6c667261
mov dword [esp + 0x38], 1
mov dword [esp + 0x28], esi
call fcn.0056b270
mov edx, dword [ebx + 0x14]
sub edx, dword [ebx + 0x10]
add esp, 8
sar edx, 2
mov edi, eax
mov dword [esp + 0x24], edi
test edx, edx
jbe 0x577f21
mov dword [esp + 0x14], edi
lea ecx, [ecx]
mov eax, dword [ebx + 0x14]
sub eax, dword [ebx + 0x10]
sar eax, 2
cmp ebp, eax
jb 0x577ef2
call fcn.00590486
mov edx, dword [ebx + 0x10]
mov esi, dword [edx + ebp*4]
mov edi, dword [esp + 0x14]
add dword [esp + 0x14], 0x128
mov ecx, 0x4a
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0x14]
sub eax, dword [ebx + 0x10]
inc ebp
sar eax, 2
cmp ebp, eax
jb 0x577ee0
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
lea ecx, [esp + 0x13]
call fcn.00569f60
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push esi
push edi
lea ecx, [esp + 0x23]
call fcn.00569d70
test eax, eax
jne 0x577f50
push str.failed_to_compres_file_list_n
call fcn.00569580
add esp, 4
mov eax, dword [ebx + 0x14]
sub eax, dword [ebx + 0x10]
mov ecx, dword [ebx]
mov edx, dword [esp + 0x18]
sar eax, 2
push esi
push edi
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x44], edx
call fcn.00569d40
mov esi, dword [esp + 0x5c]
push esi
push 8
mov dword [esp + 0x50], eax
lea eax, [esp + 0x3c]
push 1
push eax
call fcn.005908be
push esi
push 0x10
lea ecx, [esp + 0x54]
push 1
push ecx
call fcn.005908be
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
push esi
push 1
push edx
push eax
call fcn.005908be
push edi
call fcn.0056b2b0
mov ecx, dword [esp + 0x58]
push ecx
call fcn.0056b2b0
add esp, 0x40
lea ecx, [esp + 0x28]
mov dword [esp + 0x4c], 0xffffffff
call fcn.0056c180
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 4
Function at 0x578180
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5bc90b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push esi
push edi
mov esi, ecx
push 0x71cc6c
lea ecx, [esp + 0xc]
call fcn.0056c110
mov edi, dword [esp + 0x128]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push edi
mov ecx, esi
mov dword [esp + 0x12c], 0
call fcn.00577930
mov edx, dword [esp + 0x12c]
push edi
push edx
lea eax, [esp + 0x1c]
push 0x66240c
push eax
call fcn.00401aa0
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
lea edx, [esp + 0x14]
push 0x66060c
push edx
call fcn.0058fe50
mov esi, eax
add esp, 8
test esi, esi
jne 0x578243
mov eax, dword [esp + 0xc]
push eax
call fcn.0056b2b0
lea ecx, [esp + 0x18]
push ecx
push str.r3dFS:_unable_to_open__s_for_writing_n
call fcn.005693b0
add esp, 0xc
lea ecx, [esp + 8]
mov dword [esp + 0x120], 0xffffffff
call fcn.0056c180
xor al, al
jmp 0x57827a
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
push esi
push edx
push 1
push edi
call fcn.005908be
push esi
call fcn.0058f710
push edi
call fcn.0056b2b0
add esp, 0x18
lea ecx, [esp + 8]
mov dword [esp + 0x120], 0xffffffff
call fcn.0056c180
mov al, 1
mov ecx, dword [esp + 0x118]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x11c
ret 8

Function at 0x57a5a0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5bc8eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
push ebx
push esi
mov ebx, ecx
push 0x71cc6c
lea ecx, [esp + 0xc]
call fcn.0056c110
push 0
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
mov dword [esp + 0x120], 0
call fcn.00577280
lea ecx, [esp + 0xc]
push 0x63ec4c
push ecx
call fcn.0058fe50
mov esi, eax
add esp, 8
test esi, esi
jne 0x57a63d
lea edx, [esp + 0xc]
push edx
push str.r3dFS:_there_is_no_volume_file__s_n
call fcn.005693b0
add esp, 8
lea ecx, [esp + 8]
mov dword [esp + 0x118], 0xffffffff
call fcn.0056c180
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x108]
mov dword fs:[0], ecx
add esp, 0x114
ret
push ebp
push edi
push 2
push 0
push esi
call fcn.00594c37
push esi
call fcn.00594e71
push 0
push 0
push esi
mov edi, eax
call fcn.00594c37
lea eax, [edi + 1]
push 1
push eax
call fcn.0056b270
push esi
push 1
mov ebp, eax
push edi
push ebp
call fcn.005951e7
push esi
call fcn.0058f710
add esp, 0x38
lea ecx, [esp + 0x14]
push ecx
push edi
push ebp
lea ecx, [ebx + 0x104]
call fcn.0057a2a0
push ebp
mov bl, al
call fcn.0056b2b0
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x120], 0xffffffff
call fcn.0056c180
mov ecx, dword [esp + 0x118]
pop edi
pop ebp
pop esi
mov al, bl
pop ebx
mov dword fs:[0], ecx
add esp, 0x114
ret
Function at 0x582aa0
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x224
push esi
push 0
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x582ac1
xor eax, eax
pop esi
add esp, 0x224
ret
push edi
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], 0x224
xor edi, edi
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x582b1b
jmp 0x582ae0
lea ecx, [esp + 0x28]
push str..exe
push ecx
call fcn.005841f0
add esp, 8
test eax, eax
jne 0x582b17
lea edx, [esp + 8]
push edx
push esi
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x582ae0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x224
ret
mov edi, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 0x224
ret

Function at 0x5849d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5bce18
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
jb 0x584aa3
push ebx
push ebp
xor ebp, ebp
push edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
lea ebx, [eax + 1]
mov dword [esp + 0x24], ebp
mov eax, bind
test ebx, ebx
js 0x584a1e
shr eax, 1
test ebx, eax
je 0x584a18
add eax, eax
push eax
lea ecx, [esp + 0x14]
call fcn.005848b0
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov edi, dword [esp + 0x10]
push eax
push ecx
push edi
call fcn.00584870
mov eax, dword [esi + 4]
lea edx, [eax + eax*2]
lea eax, [edi + edx*8]
add esp, 0xc
cmp eax, ebp
je 0x584a6b
mov ecx, dword [esp + 0x2c]
movq xmm0, qword [ecx]
movq qword [eax], xmm0
movq xmm0, qword [ecx + 8]
movq qword [eax + 8], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [eax + 0x10], xmm0
mov eax, dword [esi]
mov ecx, dword [esp + 0x18]
push 1
mov dword [esi], edi
push 1
mov dword [esi + 4], ebx
push eax
mov dword [esi + 8], ecx
mov dword [esp + 0x30], 0xffffffff
call fcn.0056b210
add esp, 0xc
pop edi
pop ebp
pop ebx
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 4
mov ecx, dword [esi]
lea edx, [eax + eax*2]
lea ecx, [ecx + edx*8]
inc eax
mov dword [esi + 4], eax
test ecx, ecx
je 0x584ad3
mov eax, dword [esp + 0x20]
movq xmm0, qword [eax]
movq qword [ecx], xmm0
movq xmm0, qword [eax + 8]
movq qword [ecx + 8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x10], xmm0
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x589cf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [esp + 4]
test edx, edx
je 0x589d24
mov cl, byte [edx]
test cl, cl
je 0x589d24
mov eax, 0x811c9dc5
movsx ecx, cl
or ecx, 0x20
xor ecx, eax
imul ecx, ecx, 0x1000193
inc edx
mov eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x589d03
xor eax, 0x2a
imul eax, eax, 0x1000193
ret
xor eax, eax
ret
Function at 0x58f287
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x68ddfc]
jne 0x58f291
repz ret
jmp fcn.0059880f

Function at 0x58f4ae
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x58f4df
call fcn.0059637c
mov dword [eax], esi
call fcn.00596369
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00590460
add esp, 0x14
push 0x16
pop eax
jmp 0x58f534
test dword [ebp + 0xc], 0xfffffff9
jne 0x58f4bb
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x58f50c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0059638f
pop ecx
call fcn.00596369
mov eax, dword [eax]
jmp 0x58f534
test al, 0x10
jne 0x58f532
test al, 1
je 0x58f532
test byte [ebp + 0xc], 2
je 0x58f532
call fcn.0059637c
mov dword [eax], 5
call fcn.00596369
mov dword [eax], 0xd
jmp 0x58f503
xor eax, eax
pop esi
pop ebp
ret

Function at 0x5a3744
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00598987
and dword [ebp - 4], 0
cmp dword [0x73885c], 0
mov ebx, eax
jne 0x5a37f5
push 0x655568
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5a38a6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x65555c
push edi
call esi
test eax, eax
je 0x5a38a6
push eax
call fcn.00598915
mov dword [esp], 0x65554c
push edi
mov dword [0x73885c], eax
call esi
push eax
call fcn.00598915
mov dword [esp], 0x655538
push edi
mov dword [0x738860], eax
call esi
push eax
call fcn.00598915
mov dword [esp], 0x65551c
push edi
mov dword [0x738864], eax
call esi
push eax
call fcn.00598915
pop ecx
mov dword [0x73886c], eax
test eax, eax
je 0x5a37f5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00598915
pop ecx
mov dword [0x738868], eax
mov eax, dword [0x738868]
cmp eax, ebx
je 0x5a384d
cmp dword [0x73886c], ebx
je 0x5a384d
push eax
call fcn.00598990
push dword [0x73886c]
mov esi, eax
call fcn.00598990
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5a384d
test edi, edi
je 0x5a384d
call esi
test eax, eax
je 0x5a3844
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5a3844
test byte [ebp - 0xc], 1
jne 0x5a384d
or dword [ebp + 0x10], 0x200000
jmp 0x5a3886
mov eax, dword [0x738860]
cmp eax, ebx
je 0x5a3886
push eax
call fcn.00598990
pop ecx
test eax, eax
je 0x5a3886
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5a3886
mov eax, dword [0x738864]
cmp eax, ebx
je 0x5a3886
push eax
call fcn.00598990
pop ecx
test eax, eax
je 0x5a3886
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x73885c]
call fcn.00598990
pop ecx
test eax, eax
je 0x5a38a6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5a38a8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5ada30
Capabilities:
Get common file path

Disassembly:
push ebp
push esi
push edi
xor edi, edi
test ebx, ebx
je 0x5adaab
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
push edi
call ebp
push ebx
mov esi, eax
call fcn.005ac812
add eax, esi
add esp, 4
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x5ada67
pop edi
pop esi
pop ebp
ret
push esi
push edi
call ebp
mov ebp, eax
cmp word [edi + ebp*2 - 2], 0x5c
je 0x5ada7e
mov word [edi + ebp*2], 0x5c
add ebp, 1
push ebx
xor esi, esi
call fcn.005ac812
add esp, 4
test eax, eax
jbe 0x5adaab
lea ebp, [edi + ebp*2]
mov cx, word [ebx + esi*2]
mov word [ebp], cx
push ebx
add esi, 1
add ebp, 2
call fcn.005ac812
add esp, 4
cmp esi, eax
jb 0x5ada90
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x1002c059
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1002c098
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002c098
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002c098
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1002c098
cmp dword [ecx + 0x74], 0xe
jbe 0x1002c098
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1002ec8b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1002ed28
push ebx
push esi
call fcn.1002ec54
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1002ebe8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1002ecd5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002ed27
push edi
push eax
call fcn.1002fbb4
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1002ecf5
call fcn.1002d730
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002ed26
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1002ebe8
add esp, 0x20
test eax, eax
jne 0x1002ed14
push edi
call fcn.1002d730
jmp 0x1002ed1c
push ebx
call fcn.1002d730
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1002ef95
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10037690
push 0x10037688
push str.FlsAlloc
push 0x1f
call fcn.1002eeb1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002efc9
push dword [ebp + 8]
mov ecx, esi
call dword [0x10035174]
call esi
jmp 0x1002efcf
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1002f013
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100376a0
push 0x10037698
push str.FlsGetValue
push 0x21
call fcn.1002eeb1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002f04a
push dword [ebp + 8]
mov ecx, esi
call dword [0x10035174]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1002f052
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100376a8
push 0x100376a0
push str.FlsSetValue
push 0x22
call fcn.1002eeb1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002f08c
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10035174]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100345e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003460d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003460d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10022de6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10089954]
jne 0x10022df0
repz ret
jmp fcn.10025ff1

Function at 0x10026c47
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10021fa4
and dword [ebp - 4], 0
cmp dword [0x1008aee8], 0
mov ebx, eax
jne 0x10026cf8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10026da9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10026da9
push eax
call fcn.10021f32
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1008aee8], eax
call esi
push eax
call fcn.10021f32
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1008aeec], eax
call esi
push eax
call fcn.10021f32
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1008aef0], eax
call esi
push eax
call fcn.10021f32
pop ecx
mov dword [0x1008aef8], eax
test eax, eax
je 0x10026cf8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10021f32
pop ecx
mov dword [0x1008aef4], eax
mov eax, dword [0x1008aef4]
cmp eax, ebx
je 0x10026d50
cmp dword [0x1008aef8], ebx
je 0x10026d50
push eax
call fcn.10021fad
push dword [0x1008aef8]
mov esi, eax
call fcn.10021fad
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10026d50
test edi, edi
je 0x10026d50
call esi
test eax, eax
je 0x10026d47
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10026d47
test byte [ebp - 0xc], 1
jne 0x10026d50
or dword [ebp + 0x10], 0x200000
jmp 0x10026d89
mov eax, dword [0x1008aeec]
cmp eax, ebx
je 0x10026d89
push eax
call fcn.10021fad
pop ecx
test eax, eax
je 0x10026d89
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10026d89
mov eax, dword [0x1008aef0]
cmp eax, ebx
je 0x10026d89
push eax
call fcn.10021fad
pop ecx
test eax, eax
je 0x10026d89
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1008aee8]
call fcn.10021fad
pop ecx
test eax, eax
je 0x10026da9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10026dab
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100321ce
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
call fcn.10001075
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
je 0x10032228
mov eax, dword [esp + 0x24]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x1c], ecx
je 0x100322e2
jmp 0x100322cb
mov eax, dword [esp + 0x18]
cmp word [eax], 0x5a4d
mov dword [esp + 0x20], eax
je 0x100321f7
jmp 0x100322cb
lea eax, [esp + 0x38]
mov dword [esp + 0x14], eax
mov dword [0x10089580], 0x1c88
call fcn.100328ba
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
jne 0x1003233f
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.10031ee5
lea ecx, [0x10032bab]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x64], edx
mov dword [esp + 0x50], 0x113e00
mov edx, dword [0x1008956c]
mov dword [esp + 0x74], edx
mov edx, dword [0x10089570]
mov dword [esp + 0x48], edx
mov dword [0x10089584], 0x1cfb
mov edx, dword [0x10089574]
mov dword [esp + 0x54], edx
mov edx, dword [0x10089578]
mov dword [esp + 0x88], edx
mov edx, dword [0x1008957c]
mov dword [esp + 0x84], edx
mov dword [0x10089580], 0x3721
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], ecx
jmp 0x10032214
mov eax, dword [esp + 0x20]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x18], eax
jmp 0x10032214
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x44], ecx
mov edx, dword [esp + 0x1c]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x80], esi
mov dword [0x10089580], 0x287
mov esi, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.10032f07
mov ecx, dword [0x10089580]
add ecx, 0x1596
mov dword [0x10089580], ecx
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
jmp 0x100321ed