joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004da0
Capabilities:
Get file version info
Identify system language via api

Disassembly:
sub esp, 0x10c
mov eax, dword [0x1001b2c0]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
xor ebx, ebx
lea ebp, [esi + 8]
push edi
mov dword [ebp], ebx
cmp eax, ebx
je 0x10004dd5
push eax
call fcn.10008648
add esp, 4
mov dword [esi + 0x14], ebx
push 0x103
lea eax, [esp + 0x19]
push ebx
lea edi, [esi + 0x24]
push eax
mov dword [esi + 0x20], ebx
mov dword [edi], ebx
mov byte [esp + 0x20], bl
call fcn.1000a830
mov ecx, dword [esi + 4]
add esp, 0xc
push ecx
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebp
lea eax, [esp + 0x18]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [esi + 0x10], eax
cmp eax, ebx
jne 0x10004e19
xor eax, eax
jmp 0x10004e7c
add eax, 0x100
push eax
mov dword [esi + 0x10], eax
call fcn.10008af7
mov ecx, dword [esi + 0x10]
push ecx
push ebx
push eax
mov dword [esi + 0x14], eax
call fcn.1000a830
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
add esp, 0x10
push edx
push eax
push ebx
lea ecx, [esp + 0x20]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
mov eax, dword [esi + 0x14]
lea edx, [esp + 0x10]
push edx
push edi
push str.VarFileInfoTranslation
push eax
mov dword [esp + 0x20], ebx
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [esp + 0x10]
shr ecx, 2
mov dword [esi + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx edx, ax
push edx
call fcn.10004ea0
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10008039
add esp, 0x10c
ret
Function at 0x10004ea0
Capabilities:
Identify system language via api

Disassembly:
sub esp, 0x10
cmp dword [esi + 0x24], 0
jne 0x10004eb1
xor eax, eax
add esp, 0x10
ret 4
push ebx
push ebp
push edi
or ebp, 0xffffffff
or ebx, 0xffffffff
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
or edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx ecx, ax
xor eax, eax
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 0x24]
cmp dword [esi + 0x20], eax
jbe 0x10004f49
lea esp, [esp]
movzx edx, word [ecx + eax*4]
cmp dx, word [esp + 0x20]
jne 0x10004f0d
movzx ebp, word [ecx + eax*4]
movzx edi, word [ecx + eax*4 + 2]
shl ebp, 0x10
or edi, ebp
mov ebp, dword [esp + 0xc]
cmp dx, word [esp + 0x14]
jne 0x10004f2a
movzx ebx, word [ecx + eax*4]
movzx ebp, word [ecx + eax*4 + 2]
shl ebx, 0x10
or ebp, ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
cmp dx, word [esp + 0x18]
jne 0x10004f43
movzx edx, word [ecx + eax*4]
movzx ebx, word [ecx + eax*4 + 2]
shl edx, 0x10
or ebx, edx
mov dword [esp + 0x10], ebx
inc eax
cmp eax, dword [esi + 0x20]
jb 0x10004ef0
movzx eax, word [ecx]
movzx ecx, word [ecx + 2]
shl eax, 0x10
or eax, ecx
or ecx, 0xffffffff
mov dword [esi + 0xc], edi
cmp edi, ecx
jne 0x10004f62
mov dword [esi + 0xc], ebp
cmp dword [esi + 0xc], ecx
jne 0x10004f6a
mov dword [esi + 0xc], ebx
pop edi
pop ebp
pop ebx
cmp dword [esi + 0xc], ecx
jne 0x10004f75
mov dword [esi + 0xc], eax
mov eax, 1
add esp, 0x10
ret 4

Function at 0x100050c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100153e5
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1001b2c0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
mov dword [esi], vtable.ProtectMgr.0
mov dword [esp + 0x18], 0
call fcn.10007225
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.100075e9
push 0x100057c0
push 0x100df440
call fcn.10007b8d
push 0x100057f0
push 0x100df44c
call fcn.10007b8d
call fcn.1000738b
lea edi, [esi + 0x30]
mov dword [esp + 0xc], edi
mov eax, edi
mov byte [esp + 0x18], 2
call fcn.10005df0
mov edi, dword [edi]
push edi
call fcn.100080c5
lea edi, [esi + 0x10]
add esp, 4
mov dword [esp + 0xc], edi
mov eax, edi
mov byte [esp + 0x18], 3
call fcn.10005df0
mov eax, dword [edi]
push eax
call fcn.100080c5
add esp, 4
mov dword [esi], vtable.Singleton_class_ProtectMgr_.0
mov dword [0x100df56c], 0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x10005190
Capabilities:
Check for peb beingdebugged flag
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
cmp eax, dword [ebp - 4]
je 0x100051f0
mov eax, dword [ebp - 0xc]
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100051ec
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x100051f2
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x10005200
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push esi
mov dword [esi + 0xc], eax
mov byte [0x100df295], 0
call fcn.10005270
call fcn.10004c10
call fcn.10007225
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.100075e9
push 0x100057c0
push 0x100df440
call fcn.10007658
push 0x100057f0
push 0x100df44c
call fcn.10007658
push esi
call fcn.10005820
call fcn.1000738b
add esi, 8
push esi
push 0
push 0
push 0x10004f80
push 0
push 0
call fcn.10008df5
add esp, 0x18
pop esi
ret

Function at 0x10005270
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100151a8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1001b2c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
xor ebx, ebx
mov eax, str.WpeSpy.dll
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100052b7
sub eax, edx
push eax
push str.WpeSpy.dll
lea ecx, [ebp - 0x2c]
call fcn.100016c0
mov dword [ebp - 4], ebx
lea ebx, [ebp - 0x2c]
call fcn.10006fe0
cmp dword [ebp - 0x14], 0x10
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x30], ecx
jb 0x100052ed
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x34], edx
jmp 0x100052f3
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov edi, dword [ebp - 0x34]
mov ebx, 0xffffffff
mov ecx, dword [ebp - 0x30]
xor eax, eax
cmp eax, ecx
jae 0x10005320
mov edx, edi
add edx, eax
movzx edx, byte [edx]
xor edx, ebx
and edx, 0xff
shr ebx, 8
xor ebx, dword [edx*4 + 0x1001c058]
inc eax
jmp 0x10005300
mov eax, ebx
not eax
mov ebx, dword [ebp - 0x38]
lea ecx, [ebp - 0x30]
push ecx
add ebx, 0x10
lea edi, [ebp - 0x44]
mov dword [ebp - 0x30], eax
call fcn.10005930
cmp dword [ebp - 0x14], 0x10
jb 0x1000534b
mov edx, dword [ebp - 0x28]
push edx
call fcn.100080c5
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10008039
mov esp, ebp
pop ebp
ret 4
Function at 0x100055c0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
lea ebp, [esp - 0x298]
sub esp, 0x298
push 0xffffffffffffffff
push 0x10015130
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x1001b2c0]
xor eax, ebp
mov dword [ebp + 0x294], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x2a0]
mov dword [ebp - 0x14], eax
mov eax, dword [eax + 0x2c]
xor ebx, ebx
cmp eax, ebx
je 0x1000578d
lea eax, [ebp + 0x224]
push eax
lea edx, [ebp + 0x1c]
push edx
push ebx
push ebx
push ecx
call fcn.100090c0
add esp, 0x14
xor eax, eax
mov word [ebp - 0x50], ax
mov edi, 7
lea eax, [ebp + 0x224]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], ebx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10005640
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp + 0x224]
lea esi, [ebp - 0x54]
call fcn.10005e30
mov dword [ebp - 4], ebx
xor ecx, ecx
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x34], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10005673
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp + 0x1c]
lea esi, [ebp - 0x38]
call fcn.10005e30
lea edx, [ebp - 0x54]
push edx
mov eax, esi
push eax
lea edi, [ebp]
mov byte [ebp - 4], 1
call fcn.10006950
mov esi, 8
add esp, 8
cmp dword [ebp - 0x20], esi
jb 0x100056ba
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.100080c5
add esp, 4
xor edx, edx
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x34], dx
cmp dword [ebp - 0x3c], esi
jb 0x100056db
mov eax, dword [ebp - 0x50]
push eax
call fcn.100080c5
add esp, 4
lea ebx, [ebp]
call fcn.10007040
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x18], esi
jb 0x100056f6
mov edx, dword [ebp + 4]
mov dword [ebp - 0x18], edx
jmp 0x100056fc
lea eax, [ebp + 4]
mov dword [ebp - 0x18], eax
mov edi, dword [ebp - 0x18]
mov ebx, 0xffffffff
mov ecx, dword [ebp - 0x10]
xor eax, eax
cmp eax, ecx
jae 0x10005729
mov edx, edi
add edx, eax
movzx edx, byte [edx]
xor edx, ebx
and edx, 0xff
shr ebx, 8
xor ebx, dword [edx*4 + 0x1001c058]
inc eax
jmp 0x10005709
mov eax, ebx
not eax
mov edi, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x1c]
add edi, 0x10
push edx
mov dword [ebp - 0x10], eax
call fcn.10005a20
mov ecx, dword [eax]
mov esi, dword [edi + 0x18]
mov ebx, dword [eax + 4]
mov edi, dword [edi]
test ecx, ecx
je 0x10005755
cmp ecx, edi
je 0x1000575a
call fcn.1000856a
cmp ebx, esi
je 0x1000577b
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp - 0x14]
mov byte [eax + 4], 1
jb 0x10005777
mov ecx, dword [ebp + 4]
push ecx
call fcn.100080c5
add esp, 4
mov al, 1
jmp 0x1000578f
cmp dword [ebp + 0x18], 8
jb 0x1000578d
mov edx, dword [ebp + 4]
push edx
call fcn.100080c5
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x294]
xor ecx, ebp
call fcn.10008039
add ebp, 0x298
mov esp, ebp
pop ebp
ret 4
Function at 0x10006c20
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push esi
push edi
push 0
call fcn.10008782
mov dword [esp + 0x10], eax
mov dword [0x100df278], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x18], edx
mov dword [0x100df27c], edx
call fcn.10009960
mov esi, eax
mov ecx, 9
mov edi, 0x100df24c
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x100df270
push 0x10006b80
push 0
push 0
mov dword [0x100df270], 0x9e3400
call fcn.10008df5
add esp, 0x20
pop edi
pop esi
add esp, 0xc
ret

Function at 0x1000718a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100162c8
push 0x1000a708
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
cmp word [ecx], 0x5a4d
jne 0x10007210
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
je 0x100071e8
xor al, al
or dword [ebp - 4], 0xffffffff
jmp 0x10007216
mov edx, dword [eax + 0xd8]
lea esi, [edx + ecx]
cmp dword [ebp + 0xc], esi
jb 0x100071e0
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x100071e0
mov al, 1
jmp 0x100071e2
or dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10007275
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push esi
mov esi, dword [0x1001c640]
test esi, esi
je 0x10007299
lea eax, [esp + 4]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
jmp 0x1000727d
pop esi
pop ecx
ret

Function at 0x1000729c
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1001c64c], eax
je 0x100072b2
mov eax, 0x10dd
pop ecx
ret
push ebx
push esi
mov esi, dword [0x1001c65c]
xor ebx, ebx
cmp esi, ebx
push edi
je 0x100072ff
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [esi + 4], ebx
jne 0x100072f0
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x100072f0
push eax
call fcn.10007366
pop ecx
mov dword [esi + 0x10], ebx
mov edi, dword [esi]
push esi
call fcn.100080c5
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x100072c1
mov dword [0x1001c65c], ebx
call fcn.1000733f
mov esi, dword [0x1001c658]
cmp esi, ebx
je 0x1000732c
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [esi]
push esi
call fcn.100080c5
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x10007314
pop edi
mov dword [0x1001c658], ebx
mov dword [0x1001c64c], ebx
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x100075e9
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x1001c650]
push esi
test eax, eax
push edi
jne 0x10007653
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [esp + 0xc]
cmp edi, eax
je 0x10007651
push 8
call fcn.100080eb
mov esi, eax
pop ecx
test esi, esi
jne 0x10007615
push 8
pop edi
jmp 0x10007630
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10007641
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.100080c5
pop ecx
and dword [0x1001c654], 0
mov dword [0x1001c650], edi
mov eax, edi
jmp 0x10007653
mov dword [esi + 4], edi
mov eax, dword [0x1001c658]
mov dword [esi], eax
mov dword [0x1001c658], esi
xor eax, eax
pop edi
pop esi
ret 4
Function at 0x10007910
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, 0x7ff80000
mov ebx, 0x10000
jbe 0x10007934
lea eax, [esi - 0x7ff80000]
mov dword [ebp + 8], eax
jmp 0x10007937
mov dword [ebp + 8], ebx
cmp esi, 0x80000000
jae 0x1000794a
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x10007951
mov dword [ebp - 4], 0xfff80000
mov eax, dword [0x1001c644]
mov ecx, dword [0x1001c640]
test eax, eax
jne 0x1000796b
test ecx, ecx
je 0x10007980
mov eax, ecx
mov dword [0x1001c644], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x10007980
cmp edx, dword [ebp + 8]
jb 0x10007980
cmp edx, dword [ebp - 4]
jbe 0x10007ad9
mov eax, ecx
test ecx, ecx
mov dword [0x1001c644], eax
je 0x100079b0
test eax, eax
je 0x100079a4
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x100079a4
cmp ecx, dword [ebp + 8]
jb 0x100079a4
cmp ecx, dword [ebp - 4]
jbe 0x10007ad9
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x1001c644], eax
jne 0x1000798f
mov eax, esi
and eax, 0xffff
sub esi, eax
cmp esi, dword [ebp + 8]
mov edi, esi
jbe 0x10007a18
cmp edi, 0x70000000
jb 0x100079d5
cmp edi, 0x80000000
ja 0x100079d5
mov edi, 0x6fff0000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10007a18
cmp dword [ebp - 0x10], ebx
jne 0x100079f0
cmp dword [ebp - 0x14], ebx
jae 0x10007a00
mov eax, dword [ebp - 0x1c]
lea edi, [eax - 0x10000]
cmp edi, dword [ebp + 8]
ja 0x100079c0
jmp 0x10007a18
push 0x40
push 0x3000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x1001c644], eax
jne 0x10007a8f
cmp esi, dword [ebp - 4]
jae 0x10007b00
cmp esi, 0x70000000
jb 0x10007a36
cmp esi, 0x80000000
ja 0x10007a36
mov esi, 0x80010000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10007b00
cmp dword [ebp - 0x10], ebx
jne 0x10007a84
cmp dword [ebp - 0x14], ebx
jb 0x10007a84
mov ecx, esi
and ecx, 0xffff
je 0x10007a6c
mov eax, ebx
sub eax, ecx
sub dword [ebp - 0x14], eax
add dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x20]
push 0x40
push 0x3000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x1001c644], eax
jne 0x10007a8f
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
lea esi, [eax + ecx]
jmp 0x10007a18
mov dword [eax], 0x52727464
mov eax, dword [0x1001c644]
xor ecx, ecx
mov dword [eax + 8], ecx
mov eax, dword [0x1001c644]
mov edx, dword [0x1001c640]
mov dword [eax + 4], edx
mov eax, dword [0x1001c644]
mov dword [0x1001c640], eax
add eax, 0xffe0
mov edx, 0x7fd
mov dword [eax + 0x18], ecx
mov ecx, eax
sub eax, 0x20
dec edx
jne 0x10007ac1
mov eax, dword [0x1001c644]
mov dword [eax + 8], ecx
mov eax, dword [0x1001c644]
mov esi, dword [eax + 8]
cmp esi, dword [ebp + 8]
jb 0x10007b00
cmp esi, dword [ebp - 4]
ja 0x10007b00
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [eax + 8], ecx
call fcn.1000a830
add esp, 0xc
mov eax, esi
jmp 0x10007b02
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10007b07
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100162d8
push 0x1000a708
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10007b7c
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
cmp word [ecx], 0x5a4d
jne 0x10007b78
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
jne 0x10007b78
cmp word [eax + 0x14], 0
jne 0x10007b6d
xor eax, eax
or dword [ebp - 4], 0xffffffff
jmp 0x10007b7e
mov eax, ecx
jmp 0x10007b67
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10007b8d
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1001c64c], eax
je 0x10007bac
mov eax, 0x10dd
jmp 0x10007c82
mov eax, dword [0x1001c650]
test eax, eax
jne 0x10007c82
mov edi, dword [ebp + 8]
test edi, edi
jne 0x10007bc8
push 6
pop eax
jmp 0x10007c82
cmp dword [edi], 0
jne 0x10007bda
push 6
pop eax
mov dword [0x1001c650], eax
jmp 0x10007c7c
push 0x18
call fcn.100080eb
mov esi, eax
pop ecx
test esi, esi
jne 0x10007bed
push 8
pop edi
jmp 0x10007c66
mov edi, dword [edi]
push 0
push dword [ebp + 0xc]
call fcn.10007122
movzx ecx, byte [edi + 0x17]
mov ebx, dword [edi + 0x18]
xor edx, edx
sub ebx, ecx
cmp ecx, edx
je 0x10007c5b
cmp ecx, 0x17
ja 0x10007c5b
cmp dword [edi + 0x1c], eax
jne 0x10007c5b
lea eax, [ebp - 4]
mov dword [ebp - 4], edx
push eax
push 0x40
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10007c31
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x10007c66
mov eax, dword [ebp + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], eax
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], ebx
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x1001c65c]
mov dword [esi], eax
mov dword [0x1001c65c], esi
xor eax, eax
jmp 0x10007c82
cmp dword [0x1001c648], edx
push 9
pop edi
jne 0x10007c6c
mov dword [0x1001c650], edi
test esi, esi
je 0x10007c77
push esi
call fcn.100080c5
pop ecx
mov eax, edi
mov edi, dword [ebp + 8]
mov dword [0x1001c654], edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x10008039
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001b2c0]
jne 0x10008043
repz ret
jmp fcn.1000ac15
Function at 0x100086d6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x10008707
call fcn.1000bb12
mov dword [eax], esi
call fcn.1000baff
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.10008544
add esp, 0x14
push 0x16
pop eax
jmp 0x1000875c
test dword [ebp + 0xc], 0xfffffff9
jne 0x100086e3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10008734
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1000bb25
pop ecx
call fcn.1000baff
mov eax, dword [eax]
jmp 0x1000875c
test al, 0x10
jne 0x1000875a
test al, 1
je 0x1000875a
test byte [ebp + 0xc], 2
je 0x1000875a
call fcn.1000bb12
mov dword [eax], 5
call fcn.1000baff
mov dword [eax], 0xd
jmp 0x1000872b
xor eax, eax
pop esi
pop ebp
ret

Function at 0x100137f0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000bfbf
and dword [ebp - 4], 0
cmp dword [0x1001d18c], 0
mov ebx, eax
jne 0x100138a1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10013952
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10013952
push eax
call fcn.1000bf4d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1001d18c], eax
call esi
push eax
call fcn.1000bf4d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1001d190], eax
call esi
push eax
call fcn.1000bf4d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1001d194], eax
call esi
push eax
call fcn.1000bf4d
pop ecx
mov dword [0x1001d19c], eax
test eax, eax
je 0x100138a1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000bf4d
pop ecx
mov dword [0x1001d198], eax
mov eax, dword [0x1001d198]
cmp eax, ebx
je 0x100138f9
cmp dword [0x1001d19c], ebx
je 0x100138f9
push eax
call fcn.1000bfc8
push dword [0x1001d19c]
mov esi, eax
call fcn.1000bfc8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100138f9
test edi, edi
je 0x100138f9
call esi
test eax, eax
je 0x100138f0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100138f0
test byte [ebp - 0xc], 1
jne 0x100138f9
or dword [ebp + 0x10], 0x200000
jmp 0x10013932
mov eax, dword [0x1001d190]
cmp eax, ebx
je 0x10013932
push eax
call fcn.1000bfc8
pop ecx
test eax, eax
je 0x10013932
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10013932
mov eax, dword [0x1001d194]
cmp eax, ebx
je 0x10013932
push eax
call fcn.1000bfc8
pop ecx
test eax, eax
je 0x10013932
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1001d18c]
call fcn.1000bfc8
pop ecx
test eax, eax
je 0x10013952
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10013954
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret