joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470840
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4b13d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.004a7caf
xor eax, eax
mov dword [esi + 0x10], 0x171da8c
mov dword [esp + 0x10], eax
mov dword [esi + 0x14], eax
mov ecx, 1
mov dword [esi], method.CDC.virtual_0
mov byte [esp + 0x10], cl
mov dword [esi + 0x30], ecx
lea ecx, [esi + 0x20]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [ecx], eax
mov edx, dword [esp + 0x24]
mov dword [ecx + 4], eax
push edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00470940
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10

Function at 0x4708d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b13fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], method.CDC.virtual_0
mov eax, dword [esi + 0x30]
mov dword [esp + 0x14], 1
push eax
call fcn.00471580
lea ecx, [esi + 0x10]
mov dword [esp + 8], ecx
mov dword [ecx], method.CGdiObject.virtual_0
mov byte [esp + 0x14], 2
call fcn.004a88fd
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004a7de4
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x484eb0
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b25d0
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x485057
mov ecx, dword [0x173a728]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x484fac
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.00483bd0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.004a1d09
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.004a1c1c
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x1739130
call fcn.004a1c8a
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.00483f90
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.004a1d09
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.004a1c1c
lea ecx, [esp + 0xc]
call fcn.004a20e4
mov ecx, dword [esp + 0xc]
push 0x1739b6c
push ecx
call fcn.00490b44
add esp, 8
test eax, eax
je 0x484fd4
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x484f0d
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.004a1c1c
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.004a1c1c
jmp 0x48505b
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.00484c50
test eax, eax
push 0
je 0x48503f
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.004832f0
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x485025
cmp eax, 0x64
jg 0x485013
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [0x4b4338]
mov esi, eax
jmp 0x484fb0
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [0x4b4338]
mov esi, eax
jmp 0x484fb0
cmp eax, 0x64
jge 0x484fac
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [0x4b4338]
mov esi, eax
jmp 0x484fb0
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.004832f0
mov esi, eax
jmp 0x484fb0
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x485065
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x48db10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b29a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0048d6c0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0048d740
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0048d740
lea ecx, [esi + 0xc]
call fcn.004a1ba7
lea ecx, [esi + 0x10]
call fcn.004a1ba7
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0048ecd0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0048ecd0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0048ecd0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004a1c1c
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004a1c1c
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x439d00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x42a015
lea edi, [esi - 0x29015]
push edi
or ebp, 0xffffffff
jmp 0x439d22
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x439d29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x439d18
mov eax, 1
add ebx, ebx
jne 0x439d3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x439d30
jne 0x439d4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x439d30
xor ecx, ecx
sub eax, 3
jb 0x439d60
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x439dd2
mov ebp, eax
add ebx, ebx
jne 0x439d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x439d78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x439d9c
inc ecx
add ebx, ebx
jne 0x439d88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x439d7d
jne 0x439d99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x439d7d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x439dbc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x439dad
jmp 0x439d1e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x439dbc
add edi, ecx
jmp 0x439d1e
pop esi
mov edi, esi
mov ecx, 0xaca
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x439dda
cmp byte [edi], 7
jne 0x439dda
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x439ddf
lea edi, [esi + 0x37000]
mov eax, dword [edi]
or eax, eax
je 0x439e57
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3f234]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3f2d4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x439e0c
mov ecx, edi
jns 0x439e3b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3f2d8]
or eax, eax
je 0x439e51
mov dword [ebx], eax
add ebx, 4
jmp 0x439e29
call dword [esi + 0x3f2e8]
mov ebp, dword [esi + 0x3f2dc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x439e8b
sub esp, 0xffffff80
jmp 0x412a92
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408e84
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x31476a0
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x19ed7eee
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x1001534
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48c
mov eax, dword [0x1005048]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
call esi
push dword [ebp + 8]
mov ebx, eax
call esi
lea eax, [eax + ebx + 3]
mov edi, 0x104
cmp eax, edi
jae 0x100172c
push dword [ebp + 0xc]
call esi
lea eax, [eax + ebx + 1]
cmp eax, edi
jae 0x100172c
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x20c]
push eax
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
call esi
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
call fcn.01001a79
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
or edi, 0xffffffff
cmp eax, edi
jne 0x10015e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x100172c
xor eax, eax
cmp dword [ebp + 0x18], eax
sete al
jmp 0x100172e
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, edi
jne 0x1001613
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x100172c
test byte [ebp - 0x34c], 0x10
push dword [ebp + 0x10]
lea eax, [ebp - 0x108]
push eax
je 0x10016b5
call fcn.01001a79
push 0x1001244
lea eax, [ebp - 0x20c]
push eax
call fcn.01001a79
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
mov esi, eax
lea eax, [ebp - 0x20c]
push eax
call fcn.010019f2
cmp esi, edi
mov byte [eax], 0
je 0x1001727
lea eax, [ebp - 0x460]
push eax
call fcn.0100150f
test eax, eax
jne 0x10016a1
push dword [ebp + 0x18]
lea eax, [ebp - 0x460]
push dword [ebp + 0x14]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.01001534
test eax, eax
je 0x100172c
lea eax, [ebp - 0x48c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1001669
jmp 0x1001727
call fcn.01001a79
push dword [ebp + 0x14]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x100172c
push 0x80
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push 0x40000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, edi
je 0x1001727
lea eax, [ebp - 0x338]
push eax
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x348]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call ebx
xor eax, eax
inc eax
jmp 0x100172e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.010033ad
leave
ret 0x14
Function at 0x100176e
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x1005048]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
inc edi
test esi, esi
mov dword [ebp - 4], eax
je 0x100189b
cmp byte [esi], 0
je 0x100189b
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
inc eax
cmp eax, 0x104
jae 0x100189b
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1001897
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x100189b
test bl, 0x10
push esi
je 0x100188b
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1001244
lea eax, [ebp - 0x108]
push eax
call fcn.01001a79
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
lea eax, [ebp - 0x108]
push eax
call fcn.010019f2
cmp ebx, 0xffffffff
mov esi, eax
je 0x1001879
lea eax, [ebp - 0x21c]
push eax
call fcn.0100150f
test eax, eax
jne 0x1001867
lea eax, [ebp - 5]
sub eax, esi
cmp eax, 0x7fffffff
ja 0x1001865
lea ecx, [ebp - 0x21c]
push ecx
push eax
lea eax, [esi + 1]
push eax
call fcn.010014a0
test eax, eax
jl 0x1001865
lea eax, [ebp - 0x108]
push eax
call fcn.0100176e
test eax, eax
jne 0x1001867
xor edi, edi
lea eax, [ebp - 0x248]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1001824
lea eax, [ebp - 0x108]
push eax
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x1001891
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1001897
xor edi, edi
mov eax, edi
jmp 0x100189d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.010033ad
leave
ret 4
Function at 0x10018ac
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x1005048]
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call fcn.0100176e
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
mov edi, 0x104
cmp eax, edi
jae 0x100193f
push dword [ebp + 0xc]
call esi
cmp eax, edi
jae 0x100193f
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x20c]
push eax
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
call esi
xor ebx, ebx
xor esi, esi
push ebx
push ebx
push dword [esi + 0x1005010]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.01001534
test eax, eax
je 0x1001937
add esi, 4
cmp esi, 0x24
jb 0x1001907
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x10019a0
jmp 0x100199a
push dword [ebp + 0xc]
call fcn.0100176e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.010033ad
leave
ret 0xc
push eax
call fcn.010019f2
cmp eax, ebx
mov dword [ebp - 0x314], eax
je 0x1001997
push dword [ebp + 0xc]
lea eax, [ebp - 0x310]
push edi
push eax
call fcn.010014a0
push dword [ebp - 0x314]
lea eax, [ebp - 0x310]
push edi
push eax
call fcn.0100173d
test eax, eax
jl 0x1001997
push ebx
lea eax, [ebp - 0x310]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
add esi, 4
mov eax, dword [esi]
cmp eax, ebx
jne 0x1001950
xor esi, esi
push ebx
push ebx
push dword [esi + 0x1005034]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.01001534
add esi, 4
cmp esi, 8
jb 0x10019a2
xor esi, esi
push ebx
push ebx
push dword [esi + 0x100503c]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.01001534
add esi, 4
cmp esi, 0xc
jb 0x10019c7
xor eax, eax
inc eax
jmp 0x1001941

Function at 0x1001aba
Capabilities:
Check if file exists
Get file attributes
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push dword [ebp + 8]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1001b41
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x1001b40
push edi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x1001b3f
push edi
push esi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1001b38
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1001248
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1001b38
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
mov eax, dword [ebp - 4]
je 0x1001b29
mov edx, dword [eax + 8]
mov dword [ecx], edx
mov ecx, dword [ebp + 0x10]
cmp ecx, ebx
je 0x1001b35
mov eax, dword [eax + 0xc]
mov dword [ecx], eax
xor ebx, ebx
inc ebx
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x1001b48
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
push dword [ebp + 8]
call esi
push dword [ebp + 0xc]
mov edi, eax
call esi
push dword [ebp + 0x10]
add edi, eax
call esi
lea ebx, [edi + eax + 1]
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x1001b7c
push edi
call esi
lea ebx, [ebx + eax + 4]
inc ebx
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x1001ba2
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1001c27
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
call esi
push 0x1001254
push ebx
call esi
push dword [ebp + 0x10]
push ebx
call esi
test edi, edi
je 0x1001bd6
push 0x100124c
push ebx
call esi
push edi
push ebx
call esi
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 8]
xor esi, esi
push esi
push 0x20
push esi
push esi
push esi
push ebx
push esi
mov dword [ebp - 0x54], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push esi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x1002095
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1005048]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
push 0x104
lea eax, [ebp - 0x108]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [ebx], 0
jne 0x10020d1
lea ebx, [ebp - 0x108]
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push esi
push edi
push edi
push ebx
call fcn.01001f43
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
lea eax, [ecx + eax*4 + 4]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x100210d
lea eax, [ebp + 8]
push eax
mov eax, dword [esi]
push esi
lea eax, [edi + eax*4]
push eax
push edi
push ebx
call fcn.01001f43
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.010033ad
leave
ret 4
Function at 0x1002309
Capabilities:
Get file size
Read file via mapping

Disassembly:
push 0x38
push 0x10012c0
call fcn.0100344c
xor edi, edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x2c], edi
push edi
push 0x8000000
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov dword [ebp - 0x38], ebx
cmp ebx, 0xffffffff
jne 0x100234a
xor eax, eax
jmp 0x10023e8
mov dword [ebp - 4], edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 0x40], esi
cmp esi, 0xffffffff
je 0x10023d1
push edi
push esi
push edi
push 2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x28], eax
cmp eax, edi
je 0x10023d1
push esi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov dword [ebp - 0x24], ecx
cmp ecx, edi
je 0x10023d1
mov eax, esi
shr eax, 2
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x30], ecx
lea eax, [ecx + eax*4]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1c], edi
cmp ecx, eax
jae 0x10023ad
mov edx, dword [ecx]
add dword [ebp - 0x1c], edx
add ecx, 4
mov dword [ebp - 0x30], ecx
jmp 0x100239c
and esi, 3
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x20], edi
je 0x10023ca
movzx eax, byte [ecx]
add dword [ebp - 0x1c], eax
inc ecx
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x20]
jmp 0x10023b6
mov dword [ebp - 0x2c], 1
or dword [ebp - 4], 0xffffffff
call fcn.010023f2
cmp esi, edi
je 0x10023e6
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov eax, esi
call fcn.01003487
ret 8
Function at 0x100249d
Capabilities:
Check for time delay via gettickcount
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x1005048]
push esi
mov dword [ebp + 0x18c], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x7c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1002514
push esi
lea eax, [ebp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1002514
push 0x10012f8
push esi
lea eax, [ebp + 0x88]
push eax
call fcn.0100173d
test eax, eax
jl 0x1002514
lea eax, [ebp - 0x7c]
push eax
call fcn.010019f2
test eax, eax
je 0x1002514
push eax
push esi
lea eax, [ebp + 0x88]
push eax
call fcn.0100173d
test eax, eax
jge 0x100251b
xor eax, eax
jmp 0x1002665
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x80], eax
jmp 0x1002554
lea eax, [ebp + 0x88]
push eax
call fcn.0100176e
test eax, eax
jne 0x1002562
call ebx
sub eax, dword [ebp - 0x80]
cmp eax, 0x36ee80
ja 0x1002562
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 0x88]
push eax
call edi
cmp eax, 0xffffffff
jne 0x1002530
push esi
lea eax, [ebp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1002661
push 0x10012f8
push esi
lea eax, [ebp + 0x88]
push eax
call fcn.0100173d
push 0x10012e8
push esi
lea eax, [ebp + 0x88]
push eax
call fcn.0100173d
test eax, eax
jl 0x1002661
call ebx
mov dword [ebp - 0x80], eax
jmp 0x10025cf
lea eax, [ebp + 0x88]
push eax
call fcn.0100176e
test eax, eax
jne 0x10025dd
call ebx
sub eax, dword [ebp - 0x80]
cmp eax, 0x36ee80
ja 0x10025dd
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 0x88]
push eax
call edi
cmp eax, 0xffffffff
jne 0x10025ab
mov edi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
lea eax, [ebp + 0x88]
push eax
call edi
test eax, eax
je 0x1002661
push 0x10012f8
push esi
lea eax, [ebp + 0x88]
push eax
call fcn.0100173d
test eax, eax
jl 0x1002661
lea eax, [ebp + 0x88]
push eax
call fcn.0100176e
mov ebx, eax
push esi
lea eax, [ebp + 0x88]
push eax
call edi
test eax, eax
je 0x1002661
push 0x10012d8
push esi
lea eax, [ebp + 0x88]
push eax
call fcn.0100173d
test eax, eax
jl 0x1002661
lea eax, [ebp + 0x88]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x10012d4
push 0x10012cc
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
test eax, eax
je 0x1002661
test ebx, ebx
je 0x1002661
xor eax, eax
inc eax
jmp 0x1002663
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp + 0x18c]
pop esi
call fcn.010033ad
add ebp, 0x190
leave
ret
Function at 0x10033ad
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1005048]
jne 0x10033b6
ret
jmp 0x10033bb
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x1005048]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x10050b4]
test eax, eax
je 0x10033df
call eax
cmp dword [0x10050b8], 0
je 0x1003426
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x10050b8]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.010033ad
add ebp, 0x2a8
leave
ret