joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e272
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
call fcn.1000df1c
push 0x100408a4
push 3
push 9
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_LogonUserA]
test eax, eax
jne 0x1000e2b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x18
call fcn.1000266f
pop ecx
jmp 0x1000e39e
push dword [0x100408a4]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x1000e2cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x19
jmp 0x1000e2a5
push 0x800
call fcn.100081bc
pop ecx
mov esi, 0x200
push esi
push eax
mov dword [0x100408b4], eax
call fcn.10008382
push esi
push dword [0x100408b4]
mov dword [0x100408a8], eax
call fcn.10008382
mov ebx, 0x400
push ebx
push dword [0x100408b4]
mov dword [0x100408ac], eax
call fcn.10008382
mov edi, 0x100
push edi
push dword [0x100408ac]
mov dword [0x100408b0], eax
push dword [ebp + 0xc]
call fcn.100031c8
add esp, 0x24
push edi
push dword [0x100408a8]
push dword [ebp + 8]
call fcn.100031c8
add esp, 0xc
push esi
push dword [0x100408b0]
push dword [ebp + 0x10]
call fcn.100031c8
add esp, 0xc
lea eax, [ebp - 0x14]
push ebx
push eax
mov dword [0x100408b8], 1
call fcn.100016cb
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push dword [ebp + 8]
push 0x100315c4
push eax
call fcn.10001825
add esp, 0x18
push 0x23
lea eax, [ebp - 0x14]
call fcn.10001887
push eax
lea eax, [ebp - 0x14]
call fcn.10001884
push eax
call fcn.100012d0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
call fcn.10001864
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000e442
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], bl
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x1000e4a0
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1000e497
mov dword [ebp - 4], ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 4]
pop ebx
leave
ret

Function at 0x1000ed08
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push 0
push 1
lea eax, [esi + edi]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1000ed40
add esi, eax
cmp esi, 2
jb 0x1000ed38
cmp byte [esi + edi - 1], 0xa
jne 0x1000ed38
cmp byte [esi + edi - 2], 0xd
je 0x1000ed46
cmp esi, 0x800
jb 0x1000ed0e
or eax, 0xffffffff
pop esi
pop ebp
ret
mov byte [esi + edi - 2], 0
mov eax, esi
jmp 0x1000ed43
Function at 0x1000edb3
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
call fcn.10002e63
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000edd9
push eax
call sub.WS2_32.dll_closesocket
jmp 0x1000ee2c
push 2
pop eax
push dword [ebp + 8]
mov word [ebp - 0x10], ax
call sub.WS2_32.dll_htons
mov word [ebp - 0xe], ax
push 0x10
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 0xc], 0x100007f
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x1000ee08
push esi
jmp 0x1000edd2
push 0x78
push esi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x1000ee05
push dword [ebp + 0xc]
push esi
call fcn.1000ec6f
push 0x1000ed4f
call fcn.1000de0e
add esp, 0xc
pop esi
leave
ret

Function at 0x1000f00c
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, eax
xor edx, edx
push 3
lea eax, [edi + 2]
pop ebx
div ebx
mov ecx, dword [ebp + 0x10]
shl eax, 2
inc eax
cmp dword [ecx], eax
jae 0x1000f036
push 6
mov dword [ecx], eax
pop eax
jmp 0x1000f118
xor edx, edx
push 3
mov eax, edi
pop ebx
div ebx
mov ecx, dword [ebp + 0xc]
xor edx, edx
imul eax, eax, 3
test eax, eax
jbe 0x1000f0b5
dec eax
push ebx
pop edi
div edi
mov edi, eax
inc edi
mov edx, edi
imul edx, edx, 3
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi]
shr eax, 4
shl ebx, 4
add eax, ebx
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
movzx ebx, byte [esi + 1]
shr eax, 6
lea eax, [eax + ebx*4]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
dec edi
jne 0x1000f058
mov edi, dword [ebp + 8]
cmp edx, edi
jae 0x1000f10b
movzx eax, byte [esi]
inc edx
cmp edx, edi
jae 0x1000f0c7
movzx esi, byte [esi + 1]
jmp 0x1000f0c9
xor esi, esi
mov ebx, eax
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
shl eax, 4
mov ebx, esi
shr ebx, 4
add ebx, eax
and ebx, 0x3f
mov al, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edx, edi
jae 0x1000f101
and esi, 0xf
movsx eax, byte [esi*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x1000f104
push 0x3d
pop eax
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov eax, dword [ebp + 0x10]
mov byte [ecx], 0
sub ecx, dword [ebp + 0xc]
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1001098d
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret

Function at 0x10010bd2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0x1003cc78]
mov ebx, eax
push edi
mov eax, esi
call fcn.10011983
test eax, eax
jne 0x10010cd4
mov ecx, dword [0x1003cc7c]
cmp ecx, 1
jl 0x10010cd1
cmp ecx, 0x80
jg 0x10010cd1
mov eax, dword [ebp + 0xc]
xor edx, edx
div ecx
test edx, edx
jne 0x10010cd1
test cl, 3
jne 0x10010cd1
mov edx, esi
imul edx, edx, 0x60
mov edx, dword [edx + 0x10040910]
test edx, edx
je 0x10010c4a
push 0x1003cd00
push 0x1003cc80
push eax
push ebx
push dword [ebp + 8]
call edx
add esp, 0x14
jmp 0x10010cd4
cmp dword [ebp + 0xc], 0
je 0x10010ccd
mov edi, 0x1003cc80
jmp 0x10010c5d
mov esi, dword [0x1003cc78]
xor edx, edx
test ecx, ecx
jle 0x10010c84
mov ecx, dword [ebp + 8]
sub ecx, edi
lea eax, [edx + 0x1003cc80]
mov esi, dword [ecx + eax]
xor dword [eax], esi
add edx, 4
cmp edx, dword [0x1003cc7c]
jl 0x10010c68
mov esi, dword [0x1003cc78]
imul esi, esi, 0x60
push 0x1003cd00
push ebx
push edi
call dword [esi + 0x100408f4]
add esp, 0xc
test eax, eax
jne 0x10010cd4
mov ecx, dword [0x1003cc7c]
xor edx, edx
test ecx, ecx
jle 0x10010cc3
mov esi, ebx
sub esi, edi
lea eax, [edx + 0x1003cc80]
mov ecx, dword [esi + eax]
mov dword [eax], ecx
mov ecx, dword [0x1003cc7c]
add edx, 4
cmp edx, ecx
jl 0x10010cab
add dword [ebp + 8], ecx
add ebx, ecx
sub dword [ebp + 0xc], ecx
jne 0x10010c57
xor eax, eax
jmp 0x10010cd4
push 0x10
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10011013
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10035628]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x1003dda0]
push edi
mov ebx, ecx
mov edi, edx
mov eax, esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
call fcn.10011983
test eax, eax
jne 0x10011120
mov ecx, dword [0x1003dda4]
cmp ecx, 1
jl 0x1001111d
cmp ecx, 0x80
jg 0x1001111d
mov eax, dword [ebp + 8]
xor edx, edx
div ecx
test edx, edx
jne 0x1001111d
test cl, 3
jne 0x1001111d
mov ecx, esi
imul ecx, ecx, 0x60
mov ecx, dword [ecx + 0x10040914]
test ecx, ecx
je 0x1001109e
push 0x1003de28
push 0x1003dda8
push eax
push edi
push ebx
call ecx
add esp, 0x14
jmp 0x10011120
cmp dword [ebp + 8], 0
je 0x10011119
jmp 0x100110ac
mov esi, dword [0x1003dda0]
imul esi, esi, 0x60
push 0x1003de28
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [esi + 0x100408f8]
add esp, 0xc
test eax, eax
jne 0x10011120
mov eax, dword [0x1003dda4]
xor edi, edi
test eax, eax
jle 0x10011109
mov ecx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov eax, 0x1003dda8
sub esi, ebx
sub ebx, eax
sub ecx, eax
mov dword [ebp - 0x20], ecx
lea eax, [edi + 0x1003dda8]
lea edx, [ebx + eax]
mov ecx, dword [esi + edx]
xor ecx, dword [eax]
mov edx, dword [edx]
mov dword [eax], edx
mov edx, dword [ebp - 0x20]
mov dword [edx + eax], ecx
mov eax, dword [0x1003dda4]
add edi, 4
cmp edi, eax
jl 0x100110e5
mov ebx, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
add ebx, eax
sub dword [ebp + 8], eax
mov dword [ebp - 0x1c], ebx
jne 0x100110a6
xor eax, eax
jmp 0x10011120
push 0x10
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10020331
leave
ret
Function at 0x1001206a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebx + 0x70]
mov eax, esi
call fcn.10011f5a
test eax, eax
jne 0x100121aa
imul esi, esi, 0x68
push edi
mov edi, dword [esi + 0x100419e0]
push dword [esi + 0x100419e4]
mov dword [ebp - 8], edi
call fcn.100187ff
push edi
mov dword [ebp - 4], eax
call fcn.100187ff
cmp dword [ebp - 4], 0
pop ecx
mov edi, eax
pop ecx
mov dword [ebp - 0xc], edi
je 0x1001219b
test edi, edi
je 0x10012192
push edi
push ebx
call dword [esi + 0x10041a34]
mov edi, eax
xor eax, eax
pop ecx
pop ecx
cmp edi, eax
jne 0x10012170
cmp dword [esi + 0x100419e4], eax
jbe 0x100120f6
mov ecx, dword [ebx + 0xe8]
mov cl, byte [ecx + eax]
mov edx, dword [ebp - 4]
xor cl, 0x5c
mov byte [eax + edx], cl
inc eax
cmp eax, dword [esi + 0x100419e4]
jb 0x100120db
push ebx
call dword [esi + 0x10041a2c]
mov edi, eax
pop ecx
test edi, edi
jne 0x10012170
push dword [esi + 0x100419e4]
push dword [ebp - 4]
push ebx
call dword [esi + 0x10041a30]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x10012170
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
call dword [esi + 0x10041a30]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x10012170
push dword [ebp - 4]
push ebx
call dword [esi + 0x10041a34]
pop ecx
pop ecx
mov edi, eax
xor ecx, ecx
cmp edi, ecx
jne 0x10012170
cmp dword [ebp - 8], ecx
jbe 0x10012169
mov esi, dword [ebp - 4]
sub esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp ecx, dword [eax]
jae 0x10012169
mov eax, dword [ebp + 8]
add eax, ecx
mov dl, byte [esi + eax]
inc ecx
mov byte [eax], dl
cmp ecx, dword [ebp - 8]
jb 0x10012152
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
xor edi, edi
push dword [ebx + 0xe8]
call fcn.10018722
push dword [ebp - 0xc]
call fcn.10018722
push dword [ebp - 4]
call fcn.10018722
add esp, 0xc
mov eax, edi
jmp 0x100121a9
push dword [ebp - 4]
call fcn.10018722
pop ecx
test edi, edi
je 0x100121a6
push edi
call fcn.10018722
pop ecx
push 0xd
pop eax
pop edi
pop esi
leave
ret
Function at 0x100121ad
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, eax
call fcn.10011f5a
test eax, eax
jne 0x100121e8
push esi
mov esi, ebx
imul esi, esi, 0x68
mov dword [edi + 0x70], ebx
mov eax, dword [esi + 0x100419e0]
push dword [esi + 0x100419e4]
mov dword [ebp - 4], eax
call fcn.100187ff
pop ecx
mov dword [ebp - 8], eax
test eax, eax
jne 0x100121eb
push 0xd
pop eax
pop esi
pop ebx
leave
ret
push dword [esi + 0x100419e4]
call fcn.100187ff
pop ecx
mov dword [edi + 0xe8], eax
test eax, eax
jne 0x10012211
push 0xd
pop ebx
push dword [ebp - 8]
call fcn.10018722
pop ecx
mov eax, ebx
jmp 0x100121e7
mov ecx, dword [esi + 0x100419e4]
cmp ecx, 0x10
jae 0x10012259
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push 0x10
push 0x1003ff80
mov eax, ebx
call fcn.10011270
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x100122d9
mov eax, dword [esi + 0x100419e4]
cmp dword [ebp - 4], eax
jae 0x10012289
sub eax, dword [ebp - 4]
push eax
mov eax, dword [edi + 0xe8]
add eax, dword [ebp - 4]
jmp 0x10012281
push 0x10
push 0x1003ff80
push eax
call fcn.1001f330
mov eax, dword [esi + 0x100419e4]
add esp, 0xc
cmp eax, 0x10
jbe 0x10012289
add eax, 0xfffffff0
push eax
mov eax, dword [edi + 0xe8]
add eax, 0x10
push eax
call fcn.10011f27
pop ecx
pop ecx
xor eax, eax
cmp dword [esi + 0x100419e4], eax
jbe 0x100122ae
mov ecx, dword [edi + 0xe8]
mov cl, byte [ecx + eax]
mov edx, dword [ebp - 8]
xor cl, 0x36
mov byte [eax + edx], cl
inc eax
cmp eax, dword [esi + 0x100419e4]
jb 0x10012293
push edi
call dword [esi + 0x10041a2c]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x100122d9
push dword [esi + 0x100419e4]
push dword [ebp - 8]
push edi
call dword [esi + 0x10041a30]
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x10012204
push dword [edi + 0xe8]
call fcn.10018722
pop ecx
jmp 0x10012204
Function at 0x10020331
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10035628]
jne 0x1002033b
repz ret
jmp fcn.100240f2

Function at 0x100221a5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1001d542
and dword [ebp - 4], 0
cmp dword [0x1003c81c], 0
mov ebx, eax
jne 0x10022256
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10022307
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10022307
push eax
call fcn.1001d4d0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1003c81c], eax
call esi
push eax
call fcn.1001d4d0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1003c820], eax
call esi
push eax
call fcn.1001d4d0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1003c824], eax
call esi
push eax
call fcn.1001d4d0
pop ecx
mov dword [0x1003c82c], eax
test eax, eax
je 0x10022256
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1001d4d0
pop ecx
mov dword [0x1003c828], eax
mov eax, dword [0x1003c828]
cmp eax, ebx
je 0x100222ae
cmp dword [0x1003c82c], ebx
je 0x100222ae
push eax
call fcn.1001d54b
push dword [0x1003c82c]
mov esi, eax
call fcn.1001d54b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100222ae
test edi, edi
je 0x100222ae
call esi
test eax, eax
je 0x100222a5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100222a5
test byte [ebp - 0xc], 1
jne 0x100222ae
or dword [ebp + 0x10], 0x200000
jmp 0x100222e7
mov eax, dword [0x1003c820]
cmp eax, ebx
je 0x100222e7
push eax
call fcn.1001d54b
pop ecx
test eax, eax
je 0x100222e7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100222e7
mov eax, dword [0x1003c824]
cmp eax, ebx
je 0x100222e7
push eax
call fcn.1001d54b
pop ecx
test eax, eax
je 0x100222e7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1003c81c]
call fcn.1001d54b
pop ecx
test eax, eax
je 0x10022307
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10022309
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x30bb22f1
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x759b7512
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10001596
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10036250]
jne 0x100015a0
repz ret
jmp fcn.10005dde

Function at 0x1000925a
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x100363f8]
je 0x10009275
inc edi
cmp edi, 0x17
jb 0x10009266
cmp edi, 0x17
jae 0x100093f5
push ebp
push 3
call fcn.10014af6
cmp eax, 1
pop ecx
je 0x100093c1
push 3
call fcn.10014af6
test eax, eax
pop ecx
jne 0x100092a9
cmp dword [0x10240800], 1
je 0x100093c1
cmp ebx, 0xfc
je 0x100093f4
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x10240cf0
push ebp
call fcn.1000b870
add esp, 0xc
test eax, eax
je 0x100092df
push esi
push esi
push esi
push esi
push esi
call fcn.10005129
add esp, 0x14
push 0x104
mov esi, 0x10240d09
push esi
push 0
mov byte [0x10240e0d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10009323
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1000b870
add esp, 0xc
test eax, eax
je 0x10009323
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.10005129
add esp, 0x14
push esi
call fcn.10002180
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10009368
push esi
call fcn.10002180
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x10241004
push 0x100320a4
sub ecx, eax
push ecx
push eax
call fcn.10014a43
add esp, 0x14
test eax, eax
je 0x10009368
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.10005129
add esp, 0x14
jmp 0x1000936a
xor esi, esi
push 0x100320a0
push ebx
push ebp
call fcn.100149d2
add esp, 0xc
test eax, eax
je 0x1000938a
push esi
push esi
push esi
push esi
push esi
call fcn.10005129
add esp, 0x14
push dword [edi*8 + 0x100363fc]
push ebx
push ebp
call fcn.100149d2
add esp, 0xc
test eax, eax
je 0x100093ac
push esi
push esi
push esi
push esi
push esi
call fcn.10005129
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.10014815
add esp, 0xc
jmp 0x100093f4
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x100093f4
cmp ebp, 0xffffffff
je 0x100093f4
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x100363fc]
push dword [esi]
call fcn.10002180
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10014815
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.1000570d
xor ebx, ebx
cmp dword [0x102411cc], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x100148eb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x100149cb
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x100149cb
push eax
call fcn.1000569f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x102411cc], eax
call esi
push eax
call fcn.1000569f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x102411d0], eax
call esi
push eax
call fcn.1000569f
mov dword [0x102411d4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.10008ec5
test eax, eax
pop ecx
pop ecx
je 0x100148b9
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10005129
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x100148eb
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.1000569f
cmp eax, ebx
pop ecx
mov dword [0x102411dc], eax
je 0x100148eb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000569f
pop ecx
mov dword [0x102411d8], eax
mov eax, dword [0x102411d8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x10014970
cmp dword [0x102411dc], ecx
je 0x10014970
push eax
call fcn.10005716
push dword [0x102411dc]
mov esi, eax
call fcn.10005716
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x10014970
cmp edi, ebx
je 0x10014970
call esi
cmp eax, ebx
je 0x1001493d
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001493d
test byte [ebp - 0x18], 1
jne 0x10014970
lea eax, [ebp - 0x10]
push eax
call fcn.10008f74
test eax, eax
pop ecx
je 0x10014958
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10005129
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x10014967
or dword [ebp + 0x10], 0x200000
jmp 0x100149ab
or dword [ebp + 0x10], 0x40000
jmp 0x100149ab
mov eax, dword [0x102411d0]
cmp eax, dword [ebp - 8]
je 0x100149ab
push eax
call fcn.10005716
cmp eax, ebx
pop ecx
je 0x100149ab
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x100149ab
mov eax, dword [0x102411d4]
cmp eax, dword [ebp - 8]
je 0x100149ab
push eax
call fcn.10005716
cmp eax, ebx
pop ecx
je 0x100149ab
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x102411cc]
call fcn.10005716
cmp eax, ebx
pop ecx
je 0x100149cb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100149cd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001e490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x10033fa5
jmp loc.10260917

Function at 0x1001e5b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x10036250]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0x10033fa4
jmp loc.102b97bf
Function at 0x1001e900
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x10033fcb
jmp loc.102fe493

Function at 0x10024110
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x10036250]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x10034026
jmp fcn.102fd1eb