joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d299
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007576d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001d494
push 2
lea ecx, [ebp - 0x50]
call fcn.1001737c
and dword [ebp - 4], 0
push 2
lea ecx, [ebp - 0x44]
call fcn.1001737c
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], 0x2aa61fc2
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
jmp 0x1001d2fb
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1001d311
push dword [ebp - 0x10]
lea ecx, [ebp - 0x50]
call fcn.1001740a
and dword [eax], 0
jmp 0x1001d2f4
mov dword [ebp - 0x10], 0
jmp 0x1001d321
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1001d33a
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1001740a
mov dword [eax], 0x25d16df2
jmp 0x1001d31a
push 1
lea ecx, [ebp - 0x44]
call fcn.1001740a
and dword [eax], 0
jmp 0x1001d361
push 1
lea ecx, [ebp - 0x44]
call fcn.1001740a
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x44]
call fcn.1001740a
cmp dword [eax], 1
jg 0x1001d38d
push 1
lea ecx, [ebp - 0x44]
call fcn.1001740a
push dword [eax]
lea ecx, [ebp - 0x50]
call fcn.1001740a
cmp dword [eax], 0
je 0x1001d38b
jmp 0x1001d38d
jmp 0x1001d349
mov dword [ebp - 0x1c], 0xffffffff
mov esi, dword [ebp - 0x1c]
push 1
lea ecx, [ebp - 0x44]
call fcn.1001740a
cmp dword [eax], esi
jle 0x1001d3ae
mov dword [ebp - 0x34], 1
jmp 0x1001d3b2
and dword [ebp - 0x34], 0
push 0
lea ecx, [ebp - 0x44]
call fcn.1001740a
imul esi, dword [eax], 0xfa31
push 1
lea ecx, [ebp - 0x44]
call fcn.1001740a
cmp esi, dword [eax]
jge 0x1001d3d9
mov dword [ebp - 0x20], 1
jmp 0x1001d3dd
and dword [ebp - 0x20], 0
push 0
lea ecx, [ebp - 0x44]
call fcn.1001740a
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [eax]
je 0x1001d3f7
mov dword [ebp - 0x38], 1
jmp 0x1001d3fb
and dword [ebp - 0x38], 0
push 1
lea ecx, [ebp - 0x44]
call fcn.1001740a
push 1
lea ecx, [ebp - 0x44]
call fcn.1001740a
mov ecx, dword [ebp - 0x14]
cmp dword [eax], ecx
jle 0x1001d41f
mov dword [ebp - 0x24], 1
jmp 0x1001d423
and dword [ebp - 0x24], 0
push 1
lea ecx, [ebp - 0x50]
call fcn.1001740a
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [eax]
je 0x1001d43d
mov dword [ebp - 0x28], 1
jmp 0x1001d441
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x28], eax
jg 0x1001d452
mov dword [ebp - 0x2c], 1
jmp 0x1001d456
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x2c], eax
jge 0x1001d467
mov dword [ebp - 0x30], 1
jmp 0x1001d46b
and dword [ebp - 0x30], 0
push 1
lea ecx, [ebp - 0x44]
call fcn.1001740a
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.10017405
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.10017405
jmp 0x1001d49c
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001f388
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001f3bc
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001f3ba
push 0x2277
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1001f3cb
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
mov esp, ebp
pop ebp
ret

Function at 0x1001f3cf
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001f3f8
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001f3f6
push 0x4ec
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1001f41a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1001f5d7
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001f632
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001f613
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1001f630
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.1001740a
mov dword [eax], 0xfffffff9
jmp 0x1001f608
jmp 0x1001f650
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001f650
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esp, ebp
pop ebp
ret

Function at 0x1001fb84
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001fbb2
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001fbb0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x1001fbc9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x1002c8ba
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002c952
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
cmp dword [eax], 0
je 0x1002c915
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x1002c915
mov dword [ebp - 0xc], 1
jmp 0x1002c919
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jle 0x1002c92a
mov dword [ebp - 0x10], 1
jmp 0x1002c92e
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
cmp eax, dword [ecx]
je 0x1002c944
mov dword [ebp - 0x14], 1
jmp 0x1002c948
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
jmp 0x1002c968
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002c968
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esp, ebp
pop ebp
ret

Function at 0x1002c9d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002ca03
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002ca01
push 0x4ec
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1002ca4e
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002ca31
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1002ca4e
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x18]
call fcn.1001740a
mov dword [eax], 0xaced
jmp 0x1002ca26
mov esp, ebp
pop ebp
ret

Function at 0x1002cccc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002ccff
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov eax, dword [eax]
add eax, dword [ecx + 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx], eax
jmp 0x1002cd0e
push 0x163e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov esp, ebp
pop ebp
ret
Function at 0x1002ee4f
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002ee96
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
add ecx, dword [eax]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x1002ee9e
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esp, ebp
pop ebp
ret

Function at 0x1002ef59
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002ef71
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1002efbd
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
push dword [eax]
push 1
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
push dword [eax]
mov eax, dword [ebp - 0x20]
push dword [eax]
call fcn.10026a95
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x10030af7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0x3771
push 0x3e5a
push 0x3af7
push 1
lea eax, [ebp + 8]
push eax
push 0x36ba
call fcn.10030758
add esp, 0x1c
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10030b3b
xor eax, eax
jmp 0x10030c78
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10030b59
xor eax, eax
jmp 0x10030c78
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
push 1
call fcn.100302ba
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x10030b77
xor eax, eax
jmp 0x10030c78
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 8]
push eax
call fcn.100308fb
add esp, 0x18
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
call fcn.1003098d
add esp, 0x10
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x3d4e
push 0x6ee0
push 0xe4a
push 0x4e15
push 0x22a7
lea eax, [ebp - 8]
push eax
push 0x1528
call fcn.100309f3
add esp, 0x28
lea eax, [ebp - 4]
push eax
push 0x4233
lea eax, [ebp - 0x1c]
push eax
push 1
call fcn.10030a8e
add esp, 0x10
push dword [ebp - 4]
call fcn.1003018f
pop ecx
test eax, eax
jne 0x10030c07
xor eax, eax
jmp 0x10030c78
push dword [ebp - 4]
push 0x8e3
push 1
push 0x1a2b
call fcn.1002c061
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10030c60
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
jne 0x10030c3d
xor eax, eax
jmp 0x10030c78
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10030c56
xor eax, eax
jmp 0x10030c78
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10030c71
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x10030c75
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret

Function at 0x10030c7c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10030cc1
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
add ecx, dword [eax]
mov eax, dword [ebp - 0x18]
mov dword [eax], ecx
jmp 0x10030cdb
push 0x2277
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret
Function at 0x10043f81
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10043f99
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x10043fe4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10043fc7
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x10043fe4
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.1001740a
mov dword [eax], 0xeede0b40
jmp 0x10043fbc
mov esp, ebp
pop ebp
ret
Function at 0x100472bd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10047307
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100472ed
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jg 0x10047305
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
jmp 0x100472e2
jmp 0x10047337
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10047337
push 0x2277
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret

Function at 0x1004733b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10047355
push 0x4ec
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x10047369
push 0
push 0x254e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
pop ebp
ret

Function at 0x10047550
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10047574
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10047572
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x10047592
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10047592
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov esp, ebp
pop ebp
ret
Function at 0x10047a16
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100765fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10047a4d
push 0xc69
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x10047ba7
mov dword [ebp - 0x30], 0xb0ceafd
mov dword [ebp - 0x48], 0xca968364
mov dword [ebp - 0x14], 0xb0ae28de
mov dword [ebp - 0x34], 0xb1510afb
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x44], 0
push 1
lea ecx, [ebp - 0x68]
call fcn.1001737c
and dword [ebp - 4], 0
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x10], 0
jmp 0x10047a9c
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x10047ab5
push dword [ebp - 0x10]
lea ecx, [ebp - 0x68]
call fcn.1001740a
mov dword [eax], 4
jmp 0x10047a95
cmp dword [ebp - 0x14], 0
jne 0x10047aca
mov eax, 0xffff
test eax, eax
jne 0x10047aca
and dword [ebp - 0x1c], 0
jmp 0x10047ad1
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x24]
je 0x10047ae6
mov dword [ebp - 0x38], 1
jmp 0x10047aea
and dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x50], eax
push 0xfffffffffffffffe
pop eax
cmp eax, 0x10fb
jl 0x10047b03
mov dword [ebp - 0x3c], 1
jmp 0x10047b07
and dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x34]
add eax, 0xfff9
cmp eax, dword [ebp - 0x14]
jle 0x10047b23
mov dword [ebp - 0x20], 1
jmp 0x10047b27
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], 0x9d1f
jl 0x10047b39
mov dword [ebp - 0x40], 1
jmp 0x10047b3d
and dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x24]
add eax, 0x707899d5
cmp eax, dword [ebp - 0x18]
jg 0x10047b5d
mov dword [ebp - 0x28], 1
jmp 0x10047b61
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
add eax, 3
jne 0x10047b72
mov dword [ebp - 0x2c], 1
jmp 0x10047b76
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x48]
jg 0x10047b8a
mov dword [ebp - 0x4c], 1
jmp 0x10047b8e
and dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x34], 0xcac24577
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10017405
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1004c63c
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0xffffffff
xor esi, esi
inc esi
mov dword [ebp - 0x14], 0xe1e87df2
mov edi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], 9
lea ecx, [ebp - 0x20]
push esi
call fcn.1001737c
mov dword [ebp - 0x14], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0x14], 0x83674579
mov dword [ebp - 0x14], 0x761be360
mov dword [ebp - 8], ebx
jmp 0x1004c695
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x2c], 0x6801fc3e
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x1004c687
mov dword [ebp - 8], ebx
jmp 0x1004c6ad
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x1004c6a0
mov dword [ebp - 8], ebx
jmp 0x1004c6c1
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x3c], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x1004c6b7
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1004c6dc
push ebx
push 0x1d35
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
inc dword [ebp - 0x34]
lea ecx, [ebp - 0x20]
call fcn.10017c12
push edi
push esi
call fcn.100482ee
mov dword [ebp - 0x14], 0x6e32
mov dword [ebp - 0xc], esi
mov dword [ebp - 0xc], 0x8e00f680
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0xc], 0x3895196e
mov dword [ebp - 0xc], 0x208373b2
mov dword [ebp - 0xc], 0xf09a2b44
mov dword [ebp - 0xc], 0x6950a4ba
pop ecx
mov dword [ebp - 0xc], esi
pop ecx
mov dword [ebp - 8], ebx
jmp 0x1004c739
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x10], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x1004c72f
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0xc]
je 0x1004c756
mov eax, dword [ebp - 0x10]
imul ecx, eax, 0x77e0
mov eax, dword [ebp - 0xc]
sub ecx, eax
jne 0x1004c758
mov esi, ebx
mov eax, 0xfff8
cmp eax, esi
push edi
sbb eax, eax
inc eax
cmp eax, 0x9e923e64
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 8
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
neg edx
cmp eax, edx
setne cl
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
call fcn.10030af7
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10071745
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1007a330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006248a
mov dword [ebp - 0x14], eax
cmp dword [0x1066694c], esi
jne 0x10071838
push 0x800
push esi
push 0x100078bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x100717c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10071918
push esi
push esi
push 0x100078bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10071918
push 0x100078d4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10071918
push eax
call ebx
push 0x100078e0
push edi
mov dword [0x1066694c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100078f0
push edi
mov dword [0x10666950], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007904
push edi
mov dword [0x10666954], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1066695c], eax
test eax, eax
je 0x10071835
push 0x10007920
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10666958], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007185d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10071850
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10071872
push 4
pop eax
jmp 0x1007191a
cmp dword [ebp - 0x14], esi
je 0x10071872
push dword [0x1066694c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10071857
mov eax, dword [0x10666958]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x100718d0
cmp dword [0x1066695c], edi
je 0x100718d0
push eax
call ebx
push dword [0x1066695c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100718d0
test eax, eax
je 0x100718d0
call ecx
test eax, eax
je 0x100718c5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100718c5
test byte [ebp - 8], 1
jne 0x100718d0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10071900
mov eax, dword [0x10666950]
cmp eax, edi
je 0x100718fd
push eax
call ebx
test eax, eax
je 0x100718fd
call eax
mov esi, eax
test esi, esi
je 0x100718fd
mov eax, dword [0x10666954]
cmp eax, edi
je 0x100718fd
push eax
call ebx
test eax, eax
je 0x100718fd
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1066694c]
call ebx
test eax, eax
je 0x10071918
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007191a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret