joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10038dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
cmp dword [ebp + 8], esi
push edi
je 0x100397d
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push esi
push esi
push 0x20
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1003973
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [0x100aaa8], esi
mov ecx, dword [ebp + 8]
jne 0x1003958
mov al, byte [0x100b6cc]
test al, 1
je 0x1003958
test al, 2
jne 0x1003958
mov eax, ecx
and eax, 0xff000000
cmp eax, 0xaa000000
jne 0x1003958
mov dword [0x100b6cc], ecx
push ecx
call fcn.0100567a
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
push 1
pop eax
jmp 0x100397f
call fcn.010056b9
mov dword [0x100b704], eax
xor eax, eax
pop edi
pop esi
leave
ret 8
Function at 0x1003a23
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
push str.SHELL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x14], edi
je 0x1003b3d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SHBrowseForFolder
push edi
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x1003b2a
push 0xc3
push edi
call esi
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x1003b2a
push str.SHGetPathFromIDList
push edi
call esi
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x1003b2a
cmp byte [0x100b720], bl
mov esi, 0x100b720
jne 0x1003ac7
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [sym.imp.USER32.dll_CharPrevA]
add eax, esi
push eax
push esi
call edi
cmp byte [eax], 0x5c
mov dword [ebp - 4], eax
jne 0x1003ac7
push eax
push esi
call edi
cmp byte [eax], 0x3a
je 0x1003ac7
mov eax, dword [ebp - 4]
mov byte [eax], bl
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
mov byte [edi], bl
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0x1003a02
mov dword [ebp - 0x1c], esi
call dword [ebp - 8]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x1003b18
push esi
push eax
call dword [ebp - 0xc]
cmp byte [0x100b720], bl
je 0x1003b12
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
call dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
cmp byte [edi], bl
setne al
jmp 0x1003b51
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
push 0x10
push ebx
push ebx
push 0x4c1
jmp 0x1003b47
push ebx
push 0x10
push ebx
push ebx
push 0x4c2
push dword [ebp + 8]
call fcn.01003c23
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1003d7d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceA]
push edi
push 0xa
xor edi, edi
push dword [ebp + 8]
push edi
call esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp ebx, dword [ebp + 0x10]
ja 0x1003de6
cmp dword [ebp + 0xc], edi
je 0x1003de6
cmp ebx, edi
je 0x1003dc6
push 0xa
push dword [ebp + 8]
push edi
call esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, edi
jne 0x1003dca
xor eax, eax
jmp 0x1003de8
mov edi, dword [ebp + 0xc]
mov ecx, ebx
mov edx, ecx
mov esi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1003e7d
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 1
pop ebx
push edi
mov esi, ebx
call fcn.01005a6f
test eax, eax
jne 0x1003e97
mov eax, ebx
jmp 0x1003ef6
cmp dword [0x100ae7c], 0
jne 0x1003ee4
test byte [0x100aab8], bl
jne 0x1003ee4
push 6
push 0
push 0x1002e91
mov dword [0x100b0a4], edi
push dword [0x100aa78]
push 0x7d3
push dword [0x100b6dc]
call fcn.010058e6
sub eax, 6
je 0x1003ee2
dec eax
je 0x1003efc
sub eax, 0x832
jne 0x1003ee4
mov dword [0x100ae7c], ebx
mov esi, ebx
test esi, esi
je 0x1003ef4
push pe_nt_image_headers32
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop edi
pop esi
pop ebx
ret 4
xor esi, esi
jmp 0x1003ee4

Function at 0x1004022
Capabilities:
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov cl, byte [edi]
test cl, cl
je 0x1004086
mov al, byte [edi + 1]
lea esi, [edi + 1]
xor ebx, ebx
cmp al, 0x3a
jne 0x1004046
cmp byte [edi + 2], 0x5c
jne 0x1004046
lea esi, [edi + 3]
jmp 0x1004055
cmp cl, 0x5c
jne 0x1004055
cmp al, cl
jne 0x1004055
push 2
lea esi, [edi + 2]
pop ebx
mov al, byte [esi]
test al, al
je 0x1004086
cmp al, 0x5c
jne 0x100407b
cmp byte [esi - 1], 0x3a
je 0x100407b
test ebx, ebx
je 0x100406c
dec ebx
jmp 0x100407b
and byte [esi], 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [esi], 0x5c
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
jmp 0x1004055
pop edi
pop esi
pop ebx
ret 4

Function at 0x10049d7
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get common file path
Get file attributes

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
mov esi, dword [esp + 0x118]
push edi
xor edi, edi
xor ebp, ebp
mov eax, edi
inc edi
push eax
lea eax, [esp + 0x14]
push 0x1001470
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
adc eax, sym.imp.USER32.dll_wsprintfA
add esp, 0xc
push dword [esp + 0x118]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x10]
push eax
push esi
call fcn.010059ea
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 0xffffffff
je 0x1004a3f
cmp edi, 0x190
jl 0x10049ec
jmp 0x1004a52
xor ebp, ebp
push ebp
push esi
call ebx
test eax, eax
je 0x1004a52
push 1
pop ebp
mov dword [0x100aaa0], ebp
test ebp, ebp
jne 0x1004a7d
push esi
push ebp
push 0x100146c
push dword [esp + 0x124]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x1004a7d
push 1
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push esi
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x104
ret 8
Function at 0x1004a8c
Capabilities:
Create directory
Delete directory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
je 0x1004b19
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 8]
call fcn.010049d7
test eax, eax
je 0x1004b76
lea eax, [ebp - 0x128]
mov esi, 0x100ae84
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test byte [0x100b6d4], 0x20
je 0x1004b0c
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x24]
sub eax, ebx
je 0x1004b01
dec eax
je 0x1004afa
dec eax
je 0x1004af3
dec eax
jne 0x1004b0c
push 0x1001494
jmp 0x1004b06
push 0x100148c
jmp 0x1004b06
push 0x1001484
jmp 0x1004b06
push 0x100147c
push esi
call fcn.010059ea
push 0x10012c4
push esi
call fcn.010059ea
jmp 0x1004b28
push dword [ebp + 8]
mov esi, 0x100ae84
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call fcn.01004e71
test eax, eax
jne 0x1004b48
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x1004b7e
mov dword [0x100aaa0], 1
push ebx
push dword [ebp + 0x10]
push esi
call fcn.01004f10
test eax, eax
je 0x1004b61
push 1
mov dword [0x100b704], ebx
pop eax
jmp 0x1004b78
cmp dword [0x100aaa0], ebx
je 0x1004b76
push esi
mov dword [0x100aaa0], ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
pop esi
pop ebx
leave
ret 0xc
call fcn.010056b9
mov dword [0x100b704], eax
jmp 0x1004b76
Function at 0x1004e71
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x14
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
xor ebp, ebp
cmp esi, ebp
jne 0x1004eb7
push ebp
push 0x10
push ebp
push ebp
push 0x4b5
push ebp
call fcn.01003c23
call fcn.010056b9
mov dword [0x100b704], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x10014ac
push esi
call fcn.010059ea
push ebp
push 0x4000080
push 1
push ebp
push ebp
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp edi, 0xffffffff
je 0x1004ea4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1004ea4
test al, 0x10
je 0x1004ea4
push 1
mov dword [0x100b704], ebp
pop eax
jmp 0x1004eb0
Function at 0x100562b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x1005668
push eax
push 0x10
push eax
push eax
push 0x4f0
push eax
call fcn.01003c23
call fcn.010056b9
mov dword [0x100b704], eax
xor eax, eax
leave
ret
push 2
lea eax, [ebp - 0x104]
push 2
push eax
call fcn.01004f10
leave
ret

Function at 0x10056d8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x24]
push edi
push 0x1001370
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 4], edi
call ebx
add esp, 0xc
lea eax, [ebp - 0x24]
push 0xa
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10057a1
jmp 0x100571b
xor edi, edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, edi
je 0x1005787
mov eax, dword [esi]
lea edi, [esi + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 4]
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [eax + edi + 1]
push eax
push edi
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call dword [ebp + 8]
test eax, eax
je 0x1005796
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
inc dword [ebp - 4]
lea eax, [ebp - 0x24]
push dword [ebp - 4]
push 0x1001370
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x24]
push 0xa
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x1005719
jmp 0x10057a1
mov dword [0x100b704], 0x80070714
mov dword [ebp - 8], edi
jmp 0x10057a1
and dword [ebp - 8], 0
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1005886
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0x104]
push 0x100ae84
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.010059ea
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10058d9
test al, 0x10
jne 0x10058d9
push 8
lea eax, [ebp - 0x104]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x10058e2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret 4

Function at 0x1005a6f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1005a82
xor eax, eax
jmp 0x1005a8a
not eax
shr eax, 4
and eax, 1
ret 4
Function at 0x100738c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x10073d3
cmp edx, 0x10
jl 0x10073bf
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x10073ac
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x10073d3
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x10073cb
and edx, 3
cmp edx, 3
jne 0x10073e7
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x10073ec
cmp edx, 2
jne 0x10073f8
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x10073fd
cmp edx, 1
jne 0x1007403
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x100034b0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x2808
call fcn.10010ef0
mov eax, dword [0x10017030]
xor eax, esp
mov dword [esp + 0x2804], eax
test dword [esp + 0x280c], 1
je 0x100035eb
push ebp
push esi
call dword [0x10018b64]
mov ebp, eax
lea eax, [esp + 0xc]
push 0x2800
push eax
mov byte [esp + 0x14], 0
call fcn.10006e70
lea eax, [esp + 0x14]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10003501
sub eax, edx
mov byte [esp + eax + 0xc], 0x20
inc eax
push edi
mov esi, 0x2800
sub esi, eax
lea edi, [esp + eax + 0x10]
push esi
push edi
call fcn.10006f1c
mov eax, edi
add esp, 8
lea ecx, [eax + 1]
jmp 0x10003530
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10003530
sub eax, ecx
mov byte [eax + edi], 0x20
mov edx, dword [esp + 0x281c]
lea ecx, [esp + 0x2820]
push ecx
inc eax
push edx
sub esi, eax
add eax, edi
push esi
push eax
call fcn.10007113
add esp, 0x10
push 0x1001cce0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x1001cce0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push str.ws_ext.log
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
pop edi
cmp esi, 0xffffffff
je 0x100035d7
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100035b3
push 0
lea ecx, [esp + 0xc]
push ecx
sub eax, edx
push eax
lea edx, [esp + 0x18]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1001cce0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebp
call dword [0x10018c1c]
pop esi
pop ebp
mov ecx, dword [esp + 0x2804]
xor ecx, esp
call fcn.100067b8
add esp, 0x2808
ret
Function at 0x100061e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
push 0x20088
call fcn.100067e2
xor ebx, ebx
add esp, 4
cmp eax, ebx
je 0x10006243
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov dword [eax + 0x20], ebx
mov dword [eax + 0x30], ebx
mov byte [eax + 0x34], bl
mov byte [eax + 0x35], 1
mov byte [eax + 0x36], bl
mov byte [eax + 0x37], bl
mov dword [eax + 0x38], ebx
mov dword [eax + 0x3c], ebx
mov byte [eax + 0x40], bl
mov byte [eax + 0x41], bl
mov dword [eax + 0x6c], ebx
mov dword [eax + 0x70], ebx
mov dword [eax + 0x78], ebx
mov dword [eax + 0x7c], 0x10000
mov esi, eax
jmp 0x10006245
xor esi, esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x14]
push 0x10018c84
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi], 0x10017f5c
mov ecx, dword [0x10017f60]
mov dword [esi + 4], ecx
mov edx, dword [0x10017f60]
mov dword [edx], esi
mov eax, dword [0x10017f64]
mov dword [0x10017f60], esi
cmp eax, 0x10017f64
jne 0x100062fb
mov dword [esp + 0x10], 0x400
lea esp, [esp]
mov eax, dword [0x1001ccb8]
mov edi, dword [0x1001cca0]
lea ecx, [esp + 0x24]
push ecx
lea ebx, [esp + 0x14]
mov dword [esp + 0x24], eax
call fcn.100036c0
mov ebx, eax
test edi, edi
je 0x100062c7
cmp edi, dword [ebx]
je 0x100062cc
call fcn.100069af
mov edx, dword [esp + 0x20]
cmp edx, dword [ebx + 4]
je 0x100062db
inc dword [esp + 0x10]
jmp 0x100062a0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
lea edi, [esp + 0x30]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], esi
call fcn.10006380
mov ecx, dword [esp + 0x10]
jmp 0x1000631a
mov edx, dword [eax]
mov edi, dword [eax + 4]
movzx ecx, word [eax + 8]
mov dword [edx + 4], edi
mov edx, dword [eax + 4]
mov edi, dword [eax]
mov dword [edx], edi
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [ecx*4 + 0x10018ca0], esi
push 0x10018c84
mov dword [esi + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100067b8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10017030]
jne 0x100067c2
repz ret
jmp fcn.10007ce6
Function at 0x1000fef7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100080cc
and dword [ebp - 4], 0
cmp dword [0x100189fc], 0
mov ebx, eax
jne 0x1000ffa8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10010059
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10010059
push eax
call fcn.1000805a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100189fc], eax
call esi
push eax
call fcn.1000805a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10018a00], eax
call esi
push eax
call fcn.1000805a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10018a04], eax
call esi
push eax
call fcn.1000805a
pop ecx
mov dword [0x10018a0c], eax
test eax, eax
je 0x1000ffa8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000805a
pop ecx
mov dword [0x10018a08], eax
mov eax, dword [0x10018a08]
cmp eax, ebx
je 0x10010000
cmp dword [0x10018a0c], ebx
je 0x10010000
push eax
call fcn.100080d5
push dword [0x10018a0c]
mov esi, eax
call fcn.100080d5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10010000
test edi, edi
je 0x10010000
call esi
test eax, eax
je 0x1000fff7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000fff7
test byte [ebp - 0xc], 1
jne 0x10010000
or dword [ebp + 0x10], 0x200000
jmp 0x10010039
mov eax, dword [0x10018a00]
cmp eax, ebx
je 0x10010039
push eax
call fcn.100080d5
pop ecx
test eax, eax
je 0x10010039
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10010039
mov eax, dword [0x10018a04]
cmp eax, ebx
je 0x10010039
push eax
call fcn.100080d5
pop ecx
test eax, eax
je 0x10010039
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100189fc]
call fcn.100080d5
pop ecx
test eax, eax
je 0x10010059
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001005b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001f3a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [reloc.KERNEL32.dll_LCMapStringW], 1
jne 0x1001f32
call fcn.01002520
push dword [ebp + 8]
call fcn.01002333
push 0xff
call dword [0x1007000]
pop ecx
pop ecx
pop ebp
ret

Function at 0x1001f7c
Capabilities:
Query environment variable

Disassembly:
push 0x60
push 0x10011a0
call fcn.01002f08
mov edi, 0x94
mov eax, edi
call fcn.01003070
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [reloc.KERNEL32.dll_LCMapStringW], ecx
mov eax, dword [esi + 4]
mov dword [reloc.KERNEL32.dll_LCMapStringW], eax
mov edx, dword [esi + 8]
mov dword [reloc.KERNEL32.dll_LCMapStringW], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [reloc.KERNEL32.dll_LCMapStringW], esi
cmp ecx, 2
je 0x1001fdc
or esi, 0x8000
mov dword [reloc.KERNEL32.dll_LCMapStringW], esi
shl eax, 8
add eax, edx
mov dword [reloc.KERNEL32.dll_LCMapStringW], eax
cmp word [0x1000000], 0x5a4d
jne 0x1002019
mov eax, dword [reloc.KERNEL32.dll_LCMapStringW]
cmp dword [eax + reloc.KERNEL32.dll_LCMapStringW], 0x4550
jne 0x1002019
movzx ecx, word [eax + 0x1000018]
cmp ecx, 0x10b
je 0x1002032
cmp ecx, 0x20b
je 0x100201f
and dword [ebp - 0x1c], 0
jmp 0x1002049
cmp dword [eax + reloc.KERNEL32.dll_LCMapStringW], 0xe
jbe 0x1002019
xor ecx, ecx
cmp dword [eax + reloc.KERNEL32.dll_LCMapStringW], ecx
jmp 0x1002043
cmp dword [eax + reloc.KERNEL32.dll_LCMapStringW], 0xe
jbe 0x1002019
xor ecx, ecx
cmp dword [eax + reloc.KERNEL32.dll_LCMapStringW], ecx
setne cl
mov dword [ebp - 0x1c], ecx
push 1
call fcn.01002eab
pop ecx
test eax, eax
jne 0x100205d
push 0x1c
call fcn.01001f4e
pop ecx
call fcn.01002e1d
test eax, eax
jne 0x100206e
push 0x10
call fcn.01001f4e
pop ecx
and dword [ebp - 4], 0
call fcn.01002b67
test eax, eax
jge 0x1002083
push 0x1b
call fcn.01001f1f
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [reloc.KERNEL32.dll_LCMapStringW], eax
call fcn.01002a3a
mov dword [reloc.KERNEL32.dll_LCMapStringW], eax
call fcn.01002991
test eax, eax
jge 0x10020a9
push 8
call fcn.01001f1f
pop ecx
call fcn.01002737
test eax, eax
jge 0x10020ba
push 9
call fcn.01001f1f
pop ecx
call fcn.010021db
mov dword [ebp - 0x28], eax
test eax, eax
je 0x10020cd
push eax
call fcn.01001f1f
pop ecx
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.010026c9
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x10020ef
movzx eax, word [ebp - 0x40]
jmp 0x10020f2
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push 0
push 0x1000000
call fcn.01001e05
mov esi, eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x1c], 0
jne 0x1002113
push esi
call fcn.010022cc
call fcn.01002304
jmp 0x1002145
or dword [ebp - 4], reloc.KERNEL32.dll_LCMapStringW
mov eax, esi
lea esp, [ebp - 0x7c]
call fcn.01002f43
ret
Function at 0x10022aa
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 8
call fcn.01003345
xor esi, esi
inc esi
cmp dword [reloc.KERNEL32.dll_LCMapStringW], esi
pop ecx
je 0x10022a9
cmp dword [ebp + 0xc], 0
mov dword [reloc.KERNEL32.dll_LCMapStringW], esi
mov byte [0x100790c], bl
jne 0x1002299
mov ecx, dword [reloc.KERNEL32.dll_LCMapStringW]
test ecx, ecx
je 0x1002289
mov eax, dword [reloc.KERNEL32.dll_LCMapStringW]
sub eax, 4
cmp eax, ecx
jmp 0x1002282
mov eax, dword [eax]
test eax, eax
je 0x1002274
call eax
mov eax, dword [reloc.KERNEL32.dll_LCMapStringW]
sub eax, 4
cmp eax, dword [reloc.KERNEL32.dll_LCMapStringW]
mov dword [reloc.KERNEL32.dll_LCMapStringW], eax
jae 0x100226c
push 0x100111c
mov eax, 0x1001118
call fcn.010021b9
pop ecx
push 0x1001124
mov eax, 0x1001120
call fcn.010021b9
pop ecx
test ebx, ebx
je 0x10022b8
push 8
call fcn.010032a3
pop ecx
pop esi
pop ebp
ret
push dword [ebp + 8]
mov dword [reloc.KERNEL32.dll_LCMapStringW], esi
call fcn.01002181
int3

Function at 0x100231d
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
inc ebx
push ebx
push 0
call fcn.0100222b
pop ecx
pop ecx
pop ebx
ret