joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414de6
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor dword [edi], ecx
mov edx, edx
dec ebx
add edi, 4
sub ebx, 1
cmp edi, esi
jne fcn.00414de6
sub edx, eax
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x4b93051c
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x7dad67ce
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x1000b5e2
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000b625
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000b61b
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1000b619
push 1
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
jmp 0x1000b623
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1000b639
push 0
push 0x6f57
push 0x77d8
call fcn.100125b7
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x1000caa2
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1000cad4
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1000caca
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
jmp 0x1000cad2
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1000caf5
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0x60fb
push 0
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.1000cdcb
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x1000d981
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1000da1b
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000d9db
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1000d9d9
push 0x1e02
push 0
push 0
push 0
push 0
push 0xb84
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1000da19
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
mov dword [eax], 1
mov eax, dword [ebp - 0x2c]
mov dword [eax], 1
jmp 0x1000da53
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
push 0x73c5
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push 1
push 0x36fb
call fcn.1000b597
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x100125d4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001265c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10012648
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1001262c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x10012646
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.10021e18
and dword [eax], 0
jmp 0x10012621
jmp 0x1001265a
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001265a
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x10012674
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
push 0x1044
push 0
push dword [ebp - 0x24]
call fcn.1000b6d5
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1001c3eb
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1001c421
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push 1
push 0x1cac
push dword [ebp - 0x10]
push 0x490b
call fcn.1001c49f
add esp, 0x14
jmp 0x1001c49b
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1001c45b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1001c459
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x1001c49b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1001c47d
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffe9
jne 0x1001c49b
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001c499
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
jmp 0x1001c472
mov esp, ebp
pop ebp
ret

Function at 0x1001dec0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001deff
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
push 0x4973
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x6f9
push dword [ebp - 0x10]
push 1
call fcn.1001df77
add esp, 0x18
jmp 0x1001df73
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1001df28
push 0x53d
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001df56
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001df73
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.10021e18
mov dword [eax], 0x88a137b1
jmp 0x1001df4b
mov esp, ebp
pop ebp
ret
Function at 0x1002751b
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x100275bc
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002759c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002757d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1002759a
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10021e18
mov dword [eax], 0xc15d0d65
jmp 0x10027572
jmp 0x100275ba
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100275ba
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x100275de
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
push 0x22a2
push 0x7420
push 0x77d5
push 0
call fcn.10027f44
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1003ac9f
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1003aced
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
push 0x22f6
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
push dword [eax]
push 0x1509
push 0x344e
push 0x4452
push 1
push dword [ebp - 0x18]
call fcn.1003adf3
add esp, 0x20
jmp 0x1003adef
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1003addd
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1003ad4d
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0x1b
jg 0x1003addb
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x40], 6
push 0x382c
push 0x4921
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
push 0
push 0x384
lea eax, [ebp - 0x38]
push eax
push 0x5d42
push 0x3746
push 0x322c
push 1
push 0x62fc
call fcn.10026df3
add esp, 0x30
lea eax, [ebp - 0xc]
push eax
push 0x375d
push dword [ebp - 0x3c]
push 0xd3
push dword [ebp - 8]
push 0x1304
push 0
push 1
push 0
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x44]
call fcn.10028e0c
add esp, 0x2c
jmp 0x1003ad42
jmp 0x1003adef
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003adef
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esp, ebp
pop ebp
ret
Function at 0x1003b419
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1003b4de
lea eax, [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1003b491
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
call fcn.1003bc22
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1003b4dc
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1003b4bf
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 4
jge 0x1003b4dc
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.10021e18
mov dword [eax], 1
jmp 0x1003b4b4
jmp 0x1003b533
lea eax, [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x1003b52d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003b52b
push 0x56f8
push 0x184
push 0x39fd
push 0
push 1
push 0xda0
push 0x202e
push 0x510d
push 0x4f6e
push 0
call fcn.1002e1cf
add esp, 0x28
jmp 0x1003b533
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esp, ebp
pop ebp
ret
Function at 0x100468ef
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10046969
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10046961
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1004695f
push 0x213d
push 0x513d
push 0x7f3a
push 1
push 0x590c
push 0x3d84
push 1
push 0x5016
push 1
push 0x549d
push 0x5e29
call fcn.10046556
add esp, 0x2c
jmp 0x10046967
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x10046999
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0x2e22
push 0
push dword [ebp - 0x18]
push 0x538a
push 0x6900
push 0x2e78
call fcn.10046c6d
add esp, 0x1c
mov esp, ebp
pop ebp
ret

Function at 0x100469c4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x10046a6b
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10046a1e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10046a1c
push 0x6f6c
push 0
call fcn.100485f0
pop ecx
pop ecx
jmp 0x10046a69
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10046a4c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x10046a69
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.10021e18
mov dword [eax], 0x1bbb4f5a
jmp 0x10046a41
jmp 0x10046ade
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10046aa5
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x10046aa3
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x10046ade
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x10046ade
push 0x304b
push 0x7358
push 0x31ea
push 0x2e1
push 0
push 0x3c95
call fcn.10048820
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x10046b01
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10046b2c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
push 0x15c9
push 1
push dword [ebp - 0x18]
call fcn.10046c49
add esp, 0xc
jmp 0x10046c45
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10046b61
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10046c45
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp dword [eax], 0
jne 0x10046c00
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x10046bb8
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x10046bb8
mov eax, 0x94d0f4f2
test eax, eax
jne 0x10046bb8
and dword [ebp - 8], 0
jmp 0x10046bbf
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp eax, dword [ebp - 8]
jge 0x10046bd2
mov dword [ebp - 0xc], 1
jmp 0x10046bd6
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0xc], eax
je 0x10046be9
mov dword [ebp - 0x10], 1
jmp 0x10046bed
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
add eax, 6
cmp eax, 0x5132
je 0x10046c00
and dword [ebp - 0x44], 0
jmp 0x10046c07
mov dword [ebp - 0x44], 1
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0x4b11
je 0x10046c25
mov dword [ebp - 0x14], 1
jmp 0x10046c29
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x4c]
mov dword [eax], 0
mov eax, dword [ebp - 4]
imul eax, dword [eax], 0
sub eax, dword [ebp - 0x14]
sub eax, 0x7ec40a76
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x1004fd04
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1004fda3
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1004fd85
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1004fd66
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1004fd83
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10021e18
mov dword [eax], 0xfffffffa
jmp 0x1004fd5b
jmp 0x1004fda1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1004fda1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x1004fdc4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
push 1
push dword [ebp - 0x2c]
push 0x3d32
push dword [ebp - 0x30]
call fcn.1004fcdf
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10069fc5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10074740]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1005a758
mov dword [ebp - 0x14], eax
cmp dword [0x106176e0], esi
jne 0x1006a0b8
push 0x800
push esi
push 0x100075c0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1006a045
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1006a198
push esi
push esi
push 0x100075c0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1006a198
push 0x100075d8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1006a198
push eax
call ebx
push 0x100075e4
push edi
mov dword [0x106176e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100075f4
push edi
mov dword [0x106176e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007608
push edi
mov dword [0x106176e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106176f0], eax
test eax, eax
je 0x1006a0b5
push 0x10007624
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106176ec], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006a0dd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1006a0d0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1006a0f2
push 4
pop eax
jmp 0x1006a19a
cmp dword [ebp - 0x14], esi
je 0x1006a0f2
push dword [0x106176e0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1006a0d7
mov eax, dword [0x106176ec]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1006a150
cmp dword [0x106176f0], edi
je 0x1006a150
push eax
call ebx
push dword [0x106176f0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1006a150
test eax, eax
je 0x1006a150
call ecx
test eax, eax
je 0x1006a145
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1006a145
test byte [ebp - 8], 1
jne 0x1006a150
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1006a180
mov eax, dword [0x106176e4]
cmp eax, edi
je 0x1006a17d
push eax
call ebx
test eax, eax
je 0x1006a17d
call eax
mov esi, eax
test esi, esi
je 0x1006a17d
mov eax, dword [0x106176e8]
cmp eax, edi
je 0x1006a17d
push eax
call ebx
test eax, eax
je 0x1006a17d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x106176e0]
call ebx
test eax, eax
je 0x1006a198
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1006a19a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10057c3e
mov esp, ebp
pop ebp
ret