joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e0717
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 8]
mov ecx, dword [0x101392dc]
add ecx, 0x89f
mov dword [0x101392dc], ecx
mov dword [0x101392e0], 0x1fa4
mov dword [ebp - 0x10], eax
call fcn.100df485
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x100e076f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x101392dc], 0xfffff354
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x24]
mov dword [0x101392e0], 0x1e93
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
jne 0x100e07ec
mov eax, dword [ebp - 0x34]
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x38]
add ecx, 2
mov edx, dword [ebp - 0x3c]
add edx, 1
mov esi, dword [ebp - 0x30]
cmp edx, esi
mov edi, dword [ebp - 0x40]
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], edi
jb 0x100e0804
jmp 0x100e07b5
xor eax, eax
mov ecx, 0xfffff354
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x2c]
add edx, esi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
xor esi, esi
add eax, 0x89f
mov edi, dword [ebp - 0x28]
mov ebx, dword [edi + edx*4]
mov dword [0x101392dc], eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x54], esi
mov eax, dword [ebp - 0x54]
mov ecx, eax
mov edx, dword [ebp - 0x50]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x59], bh
mov byte [ebp - 0x5a], cl
je 0x100e0880
mov al, byte [ebp - 0x59]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x58]
add edx, 1
mov ah, byte [ebp - 0x5a]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x54], edx
jne 0x100e082e
mov al, byte [ebp - 0x5a]
test al, 1
jne 0x100e088c
jmp 0x100e07c0
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov dword [0x101392dc], 0x5ea
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x101392e0], 0x19e
mov dword [ebp - 0x34], edi
jmp 0x100e07b5
Function at 0x100e08be
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [0x101392dc]
add eax, 0xfffff2a7
mov dword [0x101392dc], eax
mov dword [ebp - 0x10], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x10], eax
mov dword [0x101392e0], 0x1944
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov edx, dword [edx + 0x3c]
mov dword [0x101392dc], 0x2173
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
je 0x100e095a
mov eax, dword [ebp - 0x24]
add eax, 1
cmp eax, 0x104
setl cl
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x2d], cl
mov al, byte [ebp - 0x2d]
test al, 1
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x28], edx
jne 0x100e0919
jmp 0x100e095a
mov eax, dword [ebp - 0x28]
mov dword [0x101392e0], 0x1341
mov dword [0x101392dc], 0x356f
mov ecx, dword [ebp - 0x1c]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x34], eax
jne 0x100e0a2d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x34]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x100e0a2d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x34]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x100e0a2d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x34]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x100e0a2d
mov dword [0x101392dc], 0x8c1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x34]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x100e0a2d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x34]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x100e0a2d
mov eax, 0xb8a
mov ecx, 0x23bc
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x34]
mov di, word [edx + esi*2 - 0xe]
cmp di, 0x6c
sete bl
cmp di, 0x6c
mov byte [ebp - 0x35], bl
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], eax
je 0x100e0a14
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [0x101392dc], eax
mov cl, byte [ebp - 0x35]
and cl, 1
movzx eax, cl
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10010f12
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10010f3f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10010f3d
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x10010f63
push 0
push 0x851
push 0
push 0x223a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawTextExW]
mov esp, ebp
pop ebp
ret
Function at 0x10014077
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10014163
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0x26ff23b1
jg 0x100140ce
mov dword [ebp - 0xc], 1
jmp 0x100140d2
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0xc], eax
jne 0x100140e5
mov dword [ebp - 0x1c], 1
jmp 0x100140e9
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x10014106
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jg 0x10014106
mov dword [ebp - 0x10], 1
jmp 0x1001410a
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x10], eax
jl 0x1001411d
mov dword [ebp - 0x14], 1
jmp 0x10014121
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x18]
cmp ecx, dword [eax]
je 0x10014139
mov dword [ebp - 0x20], 1
jmp 0x1001413d
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x20]
jle 0x1001414b
mov eax, dword [ebp - 8]
cmp dword [eax], 0
mov eax, dword [ebp - 8]
mov esi, dword [eax]
push 3
mov ecx, dword [ebp - 0x34]
call fcn.10016087
add esi, dword [eax]
mov eax, dword [ebp - 0x38]
mov dword [eax], esi
jmp 0x10014177
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10014177
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10014253
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100142c2
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push dword [eax]
mov eax, dword [ebp - 0x1c]
push dword [eax]
lea eax, [ebp - 0x3c]
push eax
call fcn.1001368a
add esp, 0x10
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
call fcn.10015dfb
lea ecx, [ebp - 0x3c]
call fcn.10015e20
jmp 0x100142cf
push 0x18f0
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret
Function at 0x1001a642
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001a674
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001a672
push 0x18f0
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1001a694
push 0
push 0x84e
push 0
push 0x1f45
push 0x13d9
push 0
push 0x15ac
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov esp, ebp
pop ebp
ret

Function at 0x1001acb3
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001ad0e
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1001acef
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x1001ad0c
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x14]
call fcn.10016087
mov dword [eax], 0xfffffff9
jmp 0x1001ace4
jmp 0x1001ad22
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001ad22
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret
Function at 0x1001b5b1
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001b5c9
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1001b614
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001b5f7
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1001b614
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016087
mov dword [eax], 4
jmp 0x1001b5ec
mov esp, ebp
pop ebp
ret
Function at 0x10026199
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10026206
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0xffffffec
jmp 0x100261c9
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 5
jge 0x10026204
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0x6014efc7
imul eax, dword [ebp - 0x10], 0xfff6
neg eax
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx]
jge 0x100261f8
mov dword [ebp - 8], 1
jmp 0x100261fc
and dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
jmp 0x100261be
jmp 0x1002620e
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret

Function at 0x100262e8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002630e
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x1002631b
push 0x18f0
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret

Function at 0x100263a9
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100263ce
push 0
push 0x21f4
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x10026419
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100263fc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10026419
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016087
mov dword [eax], 1
jmp 0x100263f1
mov esp, ebp
pop ebp
ret
Function at 0x100286db
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100286f6
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x10028860
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 8]
mov ecx, 0x49a5
sub ecx, dword [eax]
mov eax, dword [ebp - 4]
cmp ecx, dword [eax]
jle 0x10028768
mov dword [ebp - 0xc], 1
jmp 0x1002876c
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0xc], eax
jl 0x1002877f
mov dword [ebp - 0x10], 1
jmp 0x10028783
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x10], eax
jge 0x10028796
mov dword [ebp - 0x14], 1
jmp 0x1002879a
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0xcd908fbd
jbe 0x100287ac
mov dword [ebp - 0x18], 1
jmp 0x100287b0
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x18]
jne 0x100287c3
mov dword [ebp - 0x1c], 1
jmp 0x100287c7
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
sub eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx]
jg 0x100287df
mov dword [ebp - 0x20], 1
jmp 0x100287e3
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], 0
jae 0x100287f2
mov dword [ebp - 0x24], 1
jmp 0x100287f6
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [eax]
mov eax, dword [ebp - 8]
cmp ecx, dword [eax]
jl 0x1002880e
mov dword [ebp - 0x28], 1
jmp 0x10028812
and dword [ebp - 0x28], 0
imul eax, dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x2c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jl 0x10028830
mov dword [ebp - 0x30], 1
jmp 0x10028834
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x30]
dec eax
jne 0x10028842
mov eax, dword [ebp - 0x58]
cmp dword [eax], 0
je 0x10028854
mov eax, 0x6f73
test eax, eax
je 0x10028854
mov dword [ebp - 0x34], 1
jmp 0x10028858
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x34]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002cf31
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0x6eec
push 0x4f33
push 0xeb
push 0x71ea
push 0x68a8
lea eax, [ebp + 8]
push eax
push 0x1b54
push 0x6aae
push 0x13cb
push 1
push 0x346c
push 0xe2f
call fcn.1002cb27
add esp, 0x34
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002cf93
xor eax, eax
jmp 0x1002d0d2
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
call fcn.1002cdb2
add esp, 0x10
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002cfbb
xor eax, eax
jmp 0x1002d0d2
lea eax, [ebp - 8]
push eax
push 1
push 0x4a83
push 0xe8f
lea eax, [ebp - 0xc]
push eax
call fcn.1002ce04
add esp, 0x14
cmp dword [ebp - 0xc], 0
jne 0x1002cfe4
xor eax, eax
jmp 0x1002d0d2
push 0x17dd
lea eax, [ebp - 0xc]
push eax
push 1
push 0x5ee5
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x10]
push dword [ebp - 8]
lea eax, [ebp - 0x24]
push eax
call fcn.1002c986
add esp, 0x20
push dword [ebp - 8]
push dword [ebp + 8]
push 1
push dword [ebp - 4]
call fcn.1002496d
add esp, 0x10
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x1002d042
lea eax, [ebp - 0x14]
push eax
push 0x52d5
push 1
lea eax, [ebp - 4]
push eax
call fcn.1002ce72
add esp, 0x10
push dword [ebp - 4]
call fcn.1002b04a
pop ecx
test eax, eax
jne 0x1002d053
xor eax, eax
jmp 0x1002d0d2
push 0
push 0x22fa
push 0x344d
push dword [ebp - 4]
call fcn.1002b167
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002d0ba
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002d089
xor eax, eax
jmp 0x1002d0d2
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002d0a2
xor eax, eax
jmp 0x1002d0d2
push 0x4c2b
push 1
push 0x38fc
lea eax, [ebp - 4]
push eax
call fcn.1002cedb
add esp, 0x10
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002d0cb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002d0cf
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1003fec5
Capabilities:
Identify system language via api
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003fef1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003feef
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x1003ff0f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1003ff0f
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret
Function at 0x10042bf0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10042c1d
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10042c1b
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x10042c25
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov esp, ebp
pop ebp
ret

Function at 0x10043596
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100435dd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
mov byte [ecx + eax], 0
jmp 0x10043600
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10043600
push 0x18f0
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret
Function at 0x10077995
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10081330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10068794
mov dword [ebp - 0x14], eax
cmp dword [0x1066e4e4], esi
jne 0x10077a88
push 0x800
push esi
push 0x1000792c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10077a15
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10077b68
push esi
push esi
push 0x1000792c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10077b68
push 0x10007944
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10077b68
push eax
call ebx
push 0x10007950
push edi
mov dword [0x1066e4e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007960
push edi
mov dword [0x1066e4e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007974
push edi
mov dword [0x1066e4ec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1066e4f4], eax
test eax, eax
je 0x10077a85
push 0x10007990
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1066e4f0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10077aad
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10077aa0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10077ac2
push 4
pop eax
jmp 0x10077b6a
cmp dword [ebp - 0x14], esi
je 0x10077ac2
push dword [0x1066e4e4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10077aa7
mov eax, dword [0x1066e4f0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10077b20
cmp dword [0x1066e4f4], edi
je 0x10077b20
push eax
call ebx
push dword [0x1066e4f4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10077b20
test eax, eax
je 0x10077b20
call ecx
test eax, eax
je 0x10077b15
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10077b15
test byte [ebp - 8], 1
jne 0x10077b20
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10077b50
mov eax, dword [0x1066e4e8]
cmp eax, edi
je 0x10077b4d
push eax
call ebx
test eax, eax
je 0x10077b4d
call eax
mov esi, eax
test esi, esi
je 0x10077b4d
mov eax, dword [0x1066e4ec]
cmp eax, edi
je 0x10077b4d
push eax
call ebx
test eax, eax
je 0x10077b4d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1066e4e4]
call ebx
test eax, eax
je 0x10077b68
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10077b6a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret