joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e490
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068826
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000e4dc
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
push 0x733d
push 0x52b3
push 1
push dword [ebp - 0x20]
call fcn.1000e5fa
add esp, 0x10
jmp 0x1000e5e9
lea eax, [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1000e501
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
jmp 0x1000e5e9
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1000e5e9
mov dword [ebp - 0x1c], 0x7024
mov dword [ebp - 0x38], 0x100078e0
cmp dword [ebp - 0x1c], 0x72dc
jle 0x1000e599
and dword [ebp - 0x14], 0
jmp 0x1000e53f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x59ea
jge 0x1000e599
and dword [ebp - 0x18], 0
jmp 0x1000e555
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5dca
jge 0x1000e597
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.1000a566
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
call fcn.10020483
push eax
call fcn.10051696
pop ecx
lea ecx, [ebp - 0x58]
call fcn.10020479
jmp 0x1000e54e
jmp 0x1000e538
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x6e57
jge 0x1000e5c3
push dword [ebp - 0x38]
call fcn.10051696
pop ecx
jmp 0x1000e5df
or dword [ebp - 4], 0xffffffff
jmp 0x1000e5e9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10013764
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10013786
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push 0
push dword [ebp - 8]
call fcn.1001bccc
pop ecx
pop ecx
jmp 0x100137c2
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100137b5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x100137c2
push 0x1cea
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret

Function at 0x10014023
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001405d
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
push 1
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x336
push dword [ebp - 0x10]
call fcn.100140d4
add esp, 0x14
jmp 0x100140d0
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10014085
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x100140d0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100140b3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x100140d0
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.100208d0
mov dword [eax], 0xa8d7d2a7
jmp 0x100140a8
mov esp, ebp
pop ebp
ret
Function at 0x1001a8ff
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1001a957
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001a94b
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001a949
push 0x2428
push 0x8b7
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
jmp 0x1001a955
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x1001a9a9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
push 0x6e76
push 0x7f68
push 0x664b
push 0x3d80
push dword [ebp - 0x18]
push 0x3142
push dword [ebp - 0x1c]
push 1
push 0x443e
push 0x60fe
push 0x205d
push 0x68d8
call fcn.10016401
add esp, 0x34
mov esp, ebp
pop ebp
ret

Function at 0x1001aa86
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001aab3
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 0x773e
push 0x6a24
push dword [ebp - 4]
push 1
call fcn.1001aafe
add esp, 0x10
jmp 0x1001aafa
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001aaed
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1001aaeb
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
jmp 0x1001aafa
push 0x1cea
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret
Function at 0x1001b9bb
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001b9e8
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push 0x7c6e
push 1
push 0x4b5d
push dword [ebp - 8]
call fcn.1001ba40
add esp, 0x10
jmp 0x1001ba3c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001ba1e
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001ba1c
push 0x1ca8
push 0
push 0x229f
call dword [sym.imp.USER32.dll_GetClassNameW]
jmp 0x1001ba3c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001ba3c
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esp, ebp
pop ebp
ret

Function at 0x1001bce8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001bd41
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001bd27
mov byte [ebp - 1], 0
push 0x7b62
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.1001a2c2
add esp, 0x10
jmp 0x1001bd3f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [eax + 0x10], 1
jmp 0x1001bda4
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001bd81
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1001bd7f
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1001bda4
mov byte [ebp - 2], 0
push 0
lea eax, [ebp - 2]
push eax
push 1
push 0x4c68
push 0x2e1
push 0x7ef9
call fcn.1000b78d
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x1001f00e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068b2d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001f076
lea eax, [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1001f05d
mov byte [ebp - 0xd], 0
push 0x5346
push 1
push 1
lea eax, [ebp - 0xd]
push eax
call fcn.1001ad9d
add esp, 0x10
jmp 0x1001f071
mov byte [ebp - 0xe], 0
movzx eax, byte [ebp - 0xe]
test eax, eax
je 0x1001f071
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
jmp 0x1001f193
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1001f187
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x1001f0e8
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0x2c
je 0x1001f185
push 1
lea ecx, [ebp - 0x5c]
call fcn.10020852
and dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
jmp 0x1001f112
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1001f12b
push dword [ebp - 0x18]
lea ecx, [ebp - 0x5c]
call fcn.100208d0
mov dword [eax], 0x29b02088
jmp 0x1001f10b
push 1
mov ecx, dword [ebp - 0x48]
call fcn.100208d0
mov esi, dword [eax]
neg esi
push 0
lea ecx, [ebp - 0x5c]
call fcn.100208d0
mov dword [eax], esi
push 0
lea ecx, [ebp - 0x5c]
call fcn.100208d0
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jne 0x1001f161
mov dword [ebp - 0x1c], 1
jmp 0x1001f165
and dword [ebp - 0x1c], 0
push 1
mov ecx, dword [ebp - 0x50]
call fcn.100208d0
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.100208b4
jmp 0x1001f0dd
jmp 0x1001f193
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100251e1
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10025230
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push 0x66c2
push 0x49f5
push 0x1a59
push dword [ebp - 4]
push 0x7d45
push 0
push dword [ebp - 8]
push 0x4078
push 0x4f48
push 0x3ee2
call fcn.1002685f
add esp, 0x28
jmp 0x1002528a
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002526a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10025268
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
jmp 0x1002528a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1002528a
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov esp, ebp
pop ebp
ret

Function at 0x1002528e
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100252bb
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push 0
push dword [ebp - 4]
push 0xa52
push 0xacb
call fcn.1002a248
add esp, 0x10
jmp 0x100252f6
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100252dd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x100252f6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov edx, 0xab388a8b
mov ecx, dword [ebp - 0x14]
call fcn.10024bd8
mov esp, ebp
pop ebp
ret

Function at 0x10025d37
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10025d88
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10025d63
call dword [sym.imp.KERNEL32.dll_GetVersion]
jmp 0x10025d86
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10025d86
push 0x1cea
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x10025db2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0
push dword [ebp - 0x1c]
push 0x16ad
call fcn.100250d1
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x10025e56
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10025eb2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10025e92
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10025e90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x10025eb0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10025eb0
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x10025ed8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push 0
push 0x2583
push dword [ebp - 0x1c]
push 0x5aff
call fcn.100279eb
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x10026388
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100263cd
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100263c3
push 0x1a5e
push 0xb6a
push 0x20fb
push 0x12c0
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
jmp 0x100263cb
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x100263ea
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0x6834
push 0x3267
push 0
call fcn.10025dd9
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x1002664e
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002667c
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
push 0x2a5c
push 0x7c20
call fcn.100266df
add esp, 0x10
jmp 0x100266da
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x100266d2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 8]
call fcn.100208d0
mov esi, eax
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 8]
call fcn.100208d0
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x100266da
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10026701
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100267e7
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002679a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
push 2
mov ecx, dword [ebp - 8]
call fcn.100208d0
mov dword [eax], 0x1d
jmp 0x1002676b
push 2
mov ecx, dword [ebp - 8]
call fcn.100208d0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
push 2
mov ecx, dword [ebp - 8]
call fcn.100208d0
cmp dword [eax], 0xffffffef
jge 0x10026798
mov dword [ebp - 0x1c], 1
push 1
lea eax, [ebp - 0x1c]
push eax
push 0x59dd
push 0
call fcn.100262ac
add esp, 0x10
jmp 0x10026753
jmp 0x100267e5
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100267c8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x100267e5
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.100208d0
mov dword [eax], 0x5b481d3e
jmp 0x100267bd
jmp 0x1002682e
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1002680b
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
jmp 0x1002682e
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x1002682e
push 0x1cea
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret
Function at 0x1002a0fb
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1002a1ce
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002a1b5
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002a184
mov ecx, dword [ebp - 4]
call fcn.1003985d
movzx eax, al
test eax, eax
jne 0x1002a1b3
push 0x19c0
push dword [ebp - 0x34]
push 0xfef
push dword [ebp - 4]
push 0x7f12
push dword [ebp - 0x38]
push 1
push 0x289a
push 1
call fcn.10029f86
add esp, 0x24
mov eax, dword [ebp - 8]
mov byte [eax], 1
jmp 0x1002a1cc
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x1002a244
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x1002a224
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x1002a222
push 1
push 0x3c93
push 1
push 0x7559
push 0
push 0xf93
push 0x7db5
call fcn.10026701
add esp, 0x1c
jmp 0x1002a244
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
movzx eax, byte [eax]
test eax, eax
je 0x1002a244
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov esp, ebp
pop ebp
ret
Function at 0x100387c3
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10038811
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100387fb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov byte [eax], 1
jmp 0x1003880f
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003880f
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10038837
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
push 0
push dword [ebp - 0x18]
push 0x2a40
push dword [ebp - 0x1c]
push 0x15b2
call fcn.10026832
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1003c55e
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1003c594
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push 0x1687
push dword [ebp - 4]
push dword [ebp - 8]
push 1
push 0xe64
call fcn.1003c5e4
add esp, 0x14
jmp 0x1003c5e0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1003c5d6
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1003c5d4
push 0x26fe
push 0
push 0
push 0xab7
call dword [sym.imp.GDI32.dll_PolyPolygon]
jmp 0x1003c5e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esp, ebp
pop ebp
ret

Function at 0x1003c6cb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1003c6fc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push 0x123c
call fcn.1003c751
add esp, 0x10
jmp 0x1003c74d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1003c72a
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003c728
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x1003c74d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1003c74d
push 0x1cea
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret