joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f5f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10076054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
mov esi, ecx
cmp bx, di
jne 0x1000f619
xor eax, eax
jmp 0x1000f6e7
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000f645
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x1000f645
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x1000f6e7
cmp dword [esi + 0x4c], 0
je 0x1000f6e4
mov ecx, esi
call fcn.1000fcd9
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1000f671
push dword [esi + 0x4c]
push edi
call fcn.1000d8e6
pop ecx
pop ecx
test al, al
je 0x1000f6e4
movzx ebx, di
jmp 0x1000f6e4
movzx eax, di
mov dword [ebp - 0x28], eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x1000f6b2
sub eax, 1
je 0x1000f6b2
dec eax
sub eax, 1
jne 0x1000f6e4
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x1000f661
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x34], eax
je 0x1000f6d5
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.10023e4b
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x1000f6e4
lea eax, [ebp - 0x28]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x30], eax
mov ax, di
jne 0x1000f6e7
mov ax, bx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100191dc
leave
ret 4

Function at 0x1000fd29
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10076054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x1000fd86
cmp byte [esi + 0x3e], bl
je 0x1000fd86
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
cmp di, ax
je 0x1000fdbf
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, ebx
je 0x1000fd97
sub eax, 1
je 0x1000fd9a
dec eax
sub eax, 1
jne 0x1000fdbf
mov byte [esi + 0x3e], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100191dc
leave
ret
mov byte [esi + 0x3e], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000fdb7
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10023e4b
add esp, 0x10
cmp edi, eax
jne 0x1000fdbf
cmp byte [esi + 0x3e], bl
sete al
jmp 0x1000fd88
xor al, al
jmp 0x1000fd88
Function at 0x100108b2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
sub eax, edi
je 0x1001090c
sub eax, 1
jne 0x1001092d
mov eax, dword [0x10078470]
mov ecx, eax
inc eax
mov dword [0x10078470], eax
test ecx, ecx
jne 0x1001092d
push esi
call fcn.10012f47
mov ecx, eax
call fcn.10017739
call fcn.10017074
mov esi, eax
lea ecx, [esi + 8]
push ecx
push edi
push esi
push 0x10017181
push edi
push edi
call fcn.10026605
add esp, 0x18
mov dword [esi + 4], eax
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
jmp 0x1001092d
sub dword [0x10078470], 1
jne 0x1001092d
call fcn.10017074
mov ecx, eax
call fcn.100170d7
call fcn.10012f47
mov ecx, eax
call fcn.100176a7
xor eax, eax
inc eax
pop edi
pop ebp
ret 0xc

Function at 0x10010b64
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x10010b8b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10003b65
jmp 0x10010c40
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x10010bad
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10010baf
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x10010c34
jg 0x10010bc4
test esi, esi
je 0x10010c34
test ecx, ecx
jl 0x10010c17
jg 0x10010bce
test eax, eax
je 0x10010c17
cmp edi, ecx
jg 0x10010be2
jl 0x10010bd8
cmp esi, eax
jae 0x10010be2
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.1001ad80
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [ebx + 0x30]
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
mov eax, dword [ebp + 8]
add eax, ecx
test edi, edi
jl 0x10010c34
jg 0x10010c1a
test esi, esi
je 0x10010c34
jmp 0x10010c1a
mov eax, dword [ebp + 8]
cmp dword [ebx + 0x4c], 0
je 0x10010c34
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.10023e4b
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10010c49
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
jg 0x10010c73
jl 0x10010c6a
test edi, edi
jne 0x10010c73
xor eax, eax
xor edx, edx
jmp 0x10010d25
cmp dword [ecx + 0x38], 0
je 0x10010c86
push esi
push edi
push edx
call fcn.10003c2e
jmp 0x10010d25
mov eax, dword [ecx + 0x1c]
push ebx
mov ebx, edi
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x10010cc6
mov eax, dword [ecx + 0x2c]
cmp dword [eax], 0
jbe 0x10010cc6
cmp dword [eax], edi
mov esi, edi
cmovb esi, dword [eax]
push esi
push dword [ebp - 0xc]
push edx
call fcn.1001ad80
mov ecx, dword [ebp - 8]
sub ebx, esi
add dword [ebp - 4], esi
add esp, 0xc
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0x10]
cmp dword [ecx + 0x4c], 0
mov edx, ebx
je 0x10010d1b
call fcn.100112c0
mov edx, ebx
jmp 0x10010cf9
push dword [ecx + 0x4c]
push eax
push 1
push dword [ebp - 4]
call fcn.10024869
add dword [ebp - 4], eax
sub ebx, eax
add esp, 0x10
mov edx, ebx
cmp eax, 0xfff
jne 0x10010d2b
mov ecx, dword [ebp - 8]
mov eax, 0xfff
cmp ebx, eax
ja 0x10010cd7
test edx, edx
je 0x10010d1b
push dword [ecx + 0x4c]
push ebx
push 1
push dword [ebp - 4]
call fcn.10024869
mov edx, ebx
add esp, 0x10
sub edx, eax
sub edi, edx
sbb esi, 0
mov eax, edi
mov edx, esi
pop ebx
pop edi
pop esi
leave
ret 0xc
sub edi, ebx
jmp 0x10010d1d
Function at 0x10010f75
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10076054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x10010f9b
xor eax, eax
jmp 0x10011064
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x10010fc4
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x10010fc4
dec dword [edx]
mov eax, ebx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x10011064
cmp dword [esi + 0x4c], 0
je 0x10011062
mov ecx, esi
call fcn.100112c0
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10010ff1
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.10024579
cmp eax, edi
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x10011062
mov byte [ebp - 0x25], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x10011031
sub eax, 1
je 0x10011031
dec eax
sub eax, 1
jne 0x10011062
push dword [esi + 0x4c]
movsx ecx, byte [ebp - 0x25]
push ecx
jmp 0x10010fe3
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x34], eax
je 0x10011054
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.10023e4b
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x10011062
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
mov eax, ebx
jne 0x10011064
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100191dc
leave
ret 4

Function at 0x100112e3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10076054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x1001133c
cmp byte [esi + 0x3d], bl
je 0x1001133c
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10011375
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, ebx
je 0x1001134d
sub eax, 1
je 0x10011350
dec eax
sub eax, 1
jne 0x10011375
mov byte [esi + 0x3d], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100191dc
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001136d
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10023e4b
add esp, 0x10
cmp edi, eax
jne 0x10011375
cmp byte [esi + 0x3d], bl
sete al
jmp 0x1001133e
xor al, al
jmp 0x1001133e
Function at 0x10011f94
Capabilities:
Enumerate processes

Disassembly:
push 0x244
mov eax, 0x1003f288
call fcn.10019d4c
mov edi, ecx
mov dword [ebp - 0x240], edi
xor ebx, ebx
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x248], esi
cmp esi, 0xffffffff
jne 0x10011fce
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100120a4
push 0x228
lea eax, [ebp - 0x238]
push ebx
push eax
call fcn.1001b300
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
lea eax, [ebp - 0x23c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10012093
cmp dword [edi + 4], 0x7432d6
mov eax, dword [edi]
mov dword [ebp - 0x244], eax
je 0x100120aa
mov dword [ebp - 0x250], edi
mov dword [ebp - 4], ebx
push 0x234
mov dword [ebp - 0x24c], ebx
call fcn.100193f8
mov edx, eax
lea esi, [ebp - 0x23c]
pop ecx
mov ecx, 0x8b
lea edi, [edx + 8]
rep movsd dword es:[edi], dword [esi]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x244]
mov edi, dword [ebp - 0x240]
mov dword [ebp - 0x24c], ebx
inc dword [edi + 4]
mov eax, dword [ecx + 4]
mov dword [edx], ecx
mov dword [edx + 4], eax
mov dword [ecx + 4], edx
lea ecx, [ebp - 0x250]
mov dword [eax], edx
call fcn.10012726
mov esi, dword [ebp - 0x248]
lea eax, [ebp - 0x23c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10012003
jmp 0x1001209b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
call fcn.10019cfb
ret
push str.list_too_long
call fcn.10017d57
int3
Function at 0x10013db2
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x1003f688
call fcn.10019d4c
mov esi, ecx
mov edi, dword [ebp + 0x14]
lea eax, [esi + 0x30]
mov dword [ebp - 0x24], eax
add eax, 4
push eax
mov dword [ebp - 0x28], vtable.AutoLock.0
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp + 8]
xor ebx, ebx
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ebx
push eax
lea ecx, [esi + 0x4c]
mov dword [ebp - 0x18], ebx
call fcn.100146e1
mov eax, dword [ebp - 0x18]
cmp eax, dword [esi + 0x50]
je 0x10013efe
mov esi, dword [eax + 0xc]
test esi, esi
je 0x10013efe
mov eax, dword [ebp + 0xc]
push 1
sub eax, ebx
pop ebx
je 0x10013ef3
dec eax
sub eax, ebx
je 0x10013ecb
sub eax, ebx
je 0x10013eb5
sub eax, ebx
je 0x10013e7f
sub eax, ebx
je 0x10013e75
sub eax, 3
je 0x10013e6b
dec eax
sub eax, ebx
jne 0x10013efe
push edi
lea ecx, [esi + 0x134]
call fcn.1000c92b
call fcn.10014f11
push edi
push 0xa
push dword [ebp + 8]
mov ecx, eax
call fcn.1000d878
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x10013efe
call fcn.10014f11
push edi
push 8
jmp 0x10013e55
call fcn.10014f11
push edi
push 5
jmp 0x10013e55
cmp byte [esi], 0
je 0x10013efe
mov eax, dword [ebp + 0x10]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1006f1a0]
movsd qword [ebp - 0x1c], xmm0
movsd xmm0, qword [esi + 0x170]
call fcn.1000d7df
movsd xmm3, qword [ebp - 0x1c]
push ebx
jmp 0x10013ee7
cmp byte [esi], 0
je 0x10013efe
movsd xmm0, qword [esi + 0x170]
call fcn.1000d7df
push 5
jmp 0x10013edf
cmp byte [esi], 0
je 0x10013efe
movsd xmm0, qword [esi + 0x170]
call fcn.1000d7df
push 4
movsd xmm3, qword [0x1006f0e0]
movaps xmm2, xmm0
mov ecx, esi
call fcn.1000e6ce
jmp 0x10013efe
push edi
push dword [ebp + 0x10]
mov ecx, esi
call fcn.1000db0d
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
call fcn.10019cfb
ret 0x10

Function at 0x10014e15
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x14
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
push esi
lea esi, [eax*2 + 2]
jb 0x10014e31
mov edx, dword [edx]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x10014e3c
mov eax, dword [eax]
push esi
push edx
push 1
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10014e54
pop esi
leave
ret 8
push str.Cannot_write_string_value:_RegSetValueExW_failed.
push eax
lea ecx, [ebp - 0x14]
call fcn.10014e71
push 0x1007406c
lea eax, [ebp - 0x14]
push eax
call fcn.1001acfd
int3
Function at 0x10017193
Capabilities:
Connect pipe
Create pipe
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5030
call fcn.1001a600
mov eax, dword [0x10076054]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x5008], 0
xor eax, eax
push ebx
push esi
xor esi, esi
mov ebx, 0x10078634
push edi
inc eax
xchg dword [ebx], eax
mov eax, dword [0x10078634]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 3
pop ebx
jmp 0x1001728d
push 0
lea eax, [ebp - 0x500c]
push eax
push 1
push str.S:_ML__NW___LW_D:_A__0x12019f___WD_
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorA]
mov eax, dword [ebp - 0x500c]
mov dword [ebp - 0x5014], eax
lea eax, [ebp - 0x5018]
push eax
push 0
push 0x200c
push 0x200c
push 0xff
push 6
push ebx
push str..pipeAppMonD_DataWindow
mov dword [ebp - 0x5018], 0xc
mov dword [ebp - 0x5010], 1
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10017314
push 0
push esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x1001725b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x1001725b
push esi
call edi
xor esi, esi
jmp 0x10017288
mov eax, dword [0x10078634]
cmp eax, 1
jne 0x10017309
lea eax, [ebp - 0x5008]
push eax
xor eax, eax
push eax
push esi
push 0x1001736d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100172ba
push eax
call edi
mov eax, dword [0x10078634]
cmp eax, 1
je 0x100171d3
mov eax, 0x10078634
xchg dword [eax], ebx
test esi, esi
je 0x100172a9
cmp esi, 0xffffffff
je 0x100172a9
push esi
call edi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100191dc
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x5030]
call fcn.10017510
cmp dword [eax + 0x14], 8
jb 0x100172d5
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x5004]
push str.CreateThread_failed:__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x5030]
call fcn.1000be69
push esi
call edi
call fcn.10014f11
lea ecx, [ebp - 0x5004]
push ecx
push 0xfffffffffffffff4
jmp 0x1001735e
test esi, esi
je 0x10017310
push esi
call edi
xor esi, esi
jmp 0x10017296
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x5030]
call fcn.10017510
cmp dword [eax + 0x14], 8
jb 0x1001732f
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x5004]
push str.CreateNamedPipe_failed:__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x5030]
call fcn.1000be69
call fcn.10014f11
lea ecx, [ebp - 0x5004]
push ecx
push 0xfffffffffffffff5
mov ecx, eax
call fcn.10012d2e
or eax, 0xffffffff
jmp 0x100172ab
Function at 0x10017739
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
lea esi, [edi + 0x28]
mov dword [edi + 0x24], ebx
push esi
push ebx
push edi
push 0x100177a3
push ebx
push ebx
mov dword [esi], ebx
call fcn.10026605
add esp, 0x18
mov dword [edi + 0x24], eax
test eax, eax
je 0x1001779c
cmp dword [esi], ebx
je 0x1001779c
mov dword [ebp - 4], ebx
push 0xa
lea ebx, [edi + 8]
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [edi + 0x20]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, 1
sete bl
je 0x1001779c
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, 0xa
jb 0x1001776c
pop edi
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x1002e9dc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002e68d

Function at 0x1002e9e7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002e817

Function at 0x10034ea3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10034b20

Function at 0x100422ba
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x1007b03c], 0
je 0x1004231b
cmp word [0x1007b210], 0xd7b2
jne 0x100422e3
cmp dword [0x1007b218], 0
jbe 0x100422e3
mov eax, 0x1007b20c
call dword [0x1007b228]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x1007905c
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
push eax
call sub.KERNEL32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x10042342
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
push eax
call sub.KERNEL32.dll_WriteFile
pop edx
ret
cmp byte [0x10079020], 0
jne 0x10042337
push 0
push 0x10079054
push 0x1007905c
push 0
call sub.USER32.dll_MessageBoxA
pop edx
ret

Function at 0x1004371a
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x10043780
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.1004265e
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.1004171e
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x1004376a
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10043787
lea eax, [ebp - 0x10]
call fcn.10042436
ret

Function at 0x10045b16
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
mov edx, esi
call fcn.1004248a
mov eax, ebx
call fcn.100428da
mov eax, dword [ebx]
call fcn.1004268a
test eax, eax
jle 0x10045b47
mov edx, 1
mov ecx, dword [ebx]
xor byte [ecx + edx - 1], 0x55
inc edx
dec eax
jne 0x10045b3c
pop esi
pop ebx
ret
Function at 0x10045e66
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
xor eax, eax
push ebp
push 0x10045eb2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 2
mov edi, esi
mov eax, edi
call fcn.10046efa
test al, al
jne 0x10045ea8
cmp word [edi], 0x5a4d
jne 0x10045ea8
lea eax, [esi + 0x3c]
mov ebx, dword [eax]
add ebx, esi
cmp dword [ebx], 0x4550
je 0x10045ea8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x10045ebe
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1004605e
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
cmp byte [0x10079230], 0
jne 0x1004613f
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
jne 0x100460b1
push 0x10000
push 0x40
call sub.KERNEL32.dll_LocalAlloc
mov ebx, eax
push 0x8000
push ebx
push esi
call sub.KERNEL32.dll_GetModuleFileNameW
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
push ebx
call sub.KERNEL32.dll_CreateFileW
mov esi, eax
jmp 0x100460e2
push 0x105
push 0x40
call sub.KERNEL32.dll_LocalAlloc
mov ebx, eax
push 0x104
push ebx
push esi
call sub.KERNEL32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
push ebx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
push ebx
call sub.KERNEL32.dll_LocalFree
cmp esi, 0xffffffff
je 0x1004613f
call sub.KERNEL32.dll_GetVersion
test eax, 0x80000000
jne 0x1004610d
push 0
push 0
push 0
push 2
push 0
push esi
call sub.KERNEL32.dll_CreateFileMappingW
mov ebx, eax
jmp 0x1004611f
push 0
push 0
push 0
push 2
push 0
push esi
call sub.KERNEL32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x10046139
push 0
push 0
push 0
push 4
push ebx
call sub.KERNEL32.dll_MapViewOfFile
mov edi, eax
push ebx
call sub.KERNEL32.dll_CloseHandle
push esi
call sub.KERNEL32.dll_CloseHandle
mov eax, edi
pop edi
pop esi
pop ebx
ret