joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100861d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100861fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100861fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10086520
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10090858
push 0x10090850
push str.FlsAlloc
push 0x1e
call fcn.10086803
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10086554
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x1008655a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1008659e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10090868
push 0x10090860
push str.FlsGetValue
push 0x20
call fcn.10086803
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100865d5
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x10089824
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100898c1
push ebx
push esi
call fcn.100898c4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1008976d
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1008986e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100898c0
push edi
push eax
call fcn.10089b35
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1008988e
call fcn.10087ad8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100898bf
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1008976d
add esp, 0x20
test eax, eax
jne 0x100898ad
push edi
call fcn.10087ad8
jmp 0x100898b5
push ebx
call fcn.10087ad8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x1000671c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x1000672b
pop dword [ebp - 0x14]
mov eax, 0x1000672b
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x63dd32a1
add dword [ebp - 0x24], 0xea7512aa
mov dword [ebp - 0x20], 0x66d256e1
add dword [ebp - 0x20], 0xcb60f564
mov dword [ebp - 0x1c], 0xac9a76fd
add dword [ebp - 0x1c], 0x9fb1cd31
mov dword [ebp - 0x18], 0xd8f90a1b
add dword [ebp - 0x18], 0x2706f5e5
lea eax, [ebp - 0x24]
push eax
mov eax, 0x197cb2e6
sub eax, 0x97bc236
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x1b75f83b
sub dword [ebp - 0x24], 0xa7038ee5
mov dword [ebp - 0x20], 0xcdf6ff0d
sub dword [ebp - 0x20], 0x8c8a9d98
mov dword [ebp - 0x1c], 0xec8db5a5
sub dword [ebp - 0x1c], 0x891e4939
mov dword [ebp - 0x18], 0xce38e993
sub dword [ebp - 0x18], 0xce38e993
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x430005e9
sub eax, 0x32ff1541
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3b97c
push 0
call eax
mov ecx, 0x52eb
mov ebx, eax
mov edi, 0x10023800
add edi, dword [ebp - 0x14]
mov edx, 0x9dfff3a5
sub edx, 0x3e9fb4d5
sub dword [ebp - 8], edi
mov esi, dword [edi]
sub dword [ebp - 0x10], eax
xor esi, edx
add dword [ebp - 0xc], edi
mov dword [ebx], esi
add ebx, 0xdf321ec7
sub ebx, 0xdf321ec3
add edi, 0x30562d4c
sub edi, 0x30562d48
loop 0x1000683c
add eax, 0x13e7f
mov ebx, eax
add eax, 5
mov ecx, 0x8c81d6e1
sub ecx, 0x7c81d6e1
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x1000b110
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
cmp eax, 0x1a
jl 0x1000b168
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jl 0x1000b168
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push 0x10
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi]
push eax
push dword [esi + 4]
push dword [esi]
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.1000671c
push 1
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4

Function at 0x1000b700
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8
Function at 0x1000db80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057176
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x10082d0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
cmp dword [eax + 0x18], 0
je 0x1000dcaf
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.1005555b
mov edi, dword [esi + 4]
mov dword [ebp - 4], 0
call sym.ScCore.dll_public:_static_class_ScCore::Encoder_const____cdecl_ScCore::Encoder::getBinary_void_
cmp dword [edi + 0x14], eax
mov eax, edi
setne cl
cmp byte [ebp + 0xc], 0
je 0x1000dbf0
test cl, cl
je 0x1000dbf0
push dword [edi + 0x2c]
lea ecx, [ebp - 0x10]
call fcn.1005555b
mov eax, dword [esi + 4]
push dword [eax + 0x14]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.1005555b
mov edi, eax
test edi, edi
jne 0x1000dc30
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1000dc30
mov eax, dword [esi + 4]
push dword [eax + 0x18]
push 1
push ecx
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov ecx, 0x34
cmp eax, 1
cmovne edi, ecx
mov eax, dword [esi + 4]
push dword [eax + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
mov ecx, dword [esi + 4]
add esp, 4
push dword [ecx + 0x18]
test eax, eax
je 0x1000dc74
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_clearerr]
add esp, 4
lea ecx, [ebp - 0x10]
mov edi, 0x34
call fcn.1005555b
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
mov ecx, dword [esi + 4]
add esp, 4
cmp edx, dword [ecx + 0x24]
jl 0x1000dc92
jg 0x1000dc8c
cmp eax, dword [ecx + 0x20]
jbe 0x1000dc92
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], edx
lea ecx, [ebp - 0x10]
call fcn.1005555b
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, 0x32
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1000de00
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005719c
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x10082d0c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x820], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x814], eax
mov eax, dword [ebx]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1005c2f4]
mov ecx, ebx
call esi
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x82c]
push eax
mov eax, dword [ebx + 4]
add eax, 4
push eax
call fcn.1005555b
add esp, 0xc
test eax, eax
jne 0x1000e004
push 0x10060560
push dword [ebx + 4]
call fcn.1005555b
mov edi, eax
add esp, 8
test edi, edi
jne 0x1000e009
mov eax, dword [ebx + 4]
push 2
push 0
push 0
mov edi, dword [eax + 0x18]
push edi
mov dword [ebp - 0x824], edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
add esp, 0x10
test eax, eax
jne 0x1000ded4
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
push 0
push 0
push 0
push edi
mov esi, eax
mov ebx, edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
add esp, 0x14
test eax, eax
je 0x1000deef
mov ebx, dword [ebp - 0x820]
mov eax, dword [ebx]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1005c2f4]
mov ecx, ebx
call esi
mov eax, 0x34
jmp 0x1000e00b
push dword [ebp - 0x814]
lea ecx, [ebp - 0x81c]
call fcn.1005555b
push 0x10060570
push dword [ebp - 0x818]
mov dword [ebp - 4], 0
call fcn.1005555b
mov edi, eax
add esp, 8
test edi, edi
jne 0x1000dfd9
mov eax, dword [ebp - 0x818]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x814], eax
mov eax, esi
or eax, ebx
je 0x1000df99
mov eax, 0x800
nop
push dword [ebp - 0x824]
cmp esi, 0x800
mov edi, esi
push 1
cmova edi, eax
lea eax, [ebp - 0x810]
push edi
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
je 0x1000dffd
push dword [ebp - 0x814]
lea eax, [ebp - 0x810]
push 1
push edi
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
test eax, eax
je 0x1000dffd
sub esi, edi
mov eax, esi
sbb ebx, 0
or eax, ebx
mov eax, 0x800
jne 0x1000df40
lea ecx, [ebp - 0x81c]
call sym.ScCore.dll_public_virtual:_int___thiscall_ScCore::File::close_void_
mov edi, eax
test edi, edi
jne 0x1000dfd9
mov eax, dword [ebp - 0x818]
add eax, 4
push eax
call fcn.1005555b
push dword [ebp - 0x828]
mov eax, dword [ebp - 0x818]
push dword [ebp - 0x82c]
add eax, 4
push eax
call fcn.10033ac0
add esp, 0x10
mov edi, eax
mov ebx, dword [ebp - 0x820]
mov eax, dword [ebx]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1005c2f4]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x81c]
call sym.ScCore.dll_public_virtual:_void___thiscall_ScCore::File::destructor_void_
jmp 0x1000e009
mov edi, 0x34
jmp 0x1000dfd9
mov edi, 0x30
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100544a0
mov esp, ebp
pop ebp
ret 4
Function at 0x10010090
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 0
push 0
call fcn.1005555b
cwde
test eax, eax
je 0x100100c2
mov ecx, dword [esi]
and al, 3
pop esi
cmp al, 2
jne 0x100100b9
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.10033310
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.10033540
mov eax, 0x30
pop esi
pop ebp
ret
Function at 0x10035310
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
mov eax, dword [0x10082d0c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
call fcn.1005555b
mov ebx, eax
test ebx, ebx
je 0x1003547c
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
je 0x1003535c
push 4
push edi
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
jne 0x10035358
push edi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x1003535c
mov edi, eax
jmp 0x10035340
push 0x100
lea eax, [ebp - 0x184]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x10035474
push 0x80
lea eax, [ebp - 0x84]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x10035474
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
jne 0x10035474
test edi, edi
je 0x10035474
push esi
push 0xfffffffffffffffc
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test esi, esi
mov dword [ebp - 0x188], eax
pop esi
je 0x10035474
cmp eax, edi
je 0x10035474
push 1
push edi
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x10035421
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push edi
push dword [ebp - 0x188]
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100544a0
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2000
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 2
lea eax, [ebp - 0x188]
mov dword [ebp - 0x188], 0
push eax
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 2
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100544a0
mov esp, ebp
pop ebp
ret
Function at 0x100354a0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
test esi, esi
jne 0x100354cb
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
push dword [ebp - 0xc]
push esi
call fcn.1005555b
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
je 0x100354f4
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov edx, dword [ebp - 8]
test eax, eax
cmove edx, esi
mov dword [ebp - 8], edx
test edx, edx
jne 0x1003550a
lea eax, [ebp - 0xc]
push eax
push 0x10035590
call dword [sym.imp.USER32.dll_EnumWindows]
mov edx, dword [ebp - 8]
test edx, edx
je 0x10035551
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10083c98]
mov dword [ebp - 4], edx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10083c10]
cmp eax, dword [ecx + 4]
jg 0x10035558
jmp 0x1003552e
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0
push dword [0x10083c0c]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 8]
test eax, eax
pop esi
cmovne ecx, dword [ebp - 4]
mov eax, ecx
mov esp, ebp
pop ebp
ret
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
push 0x10083c10
call fcn.1005555b
add esp, 4
cmp dword [0x10083c10], 0xffffffff
jne 0x1003552b
push str.adobe.sccore.get.dialog.owner
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push 0x10083c10
mov dword [0x10083c0c], eax
call fcn.1005555b
add esp, 4
jmp 0x1003552b

Function at 0x100356d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005ac13
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10082d0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.ScCore::Thread.0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 1
call fcn.1005555b
mov edi, eax
mov ebx, edx
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push sym.ScCore.dll_private:_static_unsigned_int___stdcall_ScCore::Thread::go_void__
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x10035768
mov dword [esi + 0xc], 0x20
mov eax, esi
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov dword [esi + 8], eax
mov eax, dword [0x10083ae8]
test eax, eax
jne 0x1003577c
call sym.ScCore.dll_public:_static_class_ScCore::Context____cdecl_ScCore::Context::get_void_
mov dword [eax + 0x58], edi
mov dword [eax + 0x5c], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10035810
Capabilities:
Resume thread

Disassembly:
cmp dword [ecx + 0xc], 0
jne 0x1003581f
push dword [ecx + 4]
call dword [sym.imp.kernel32.dll_ResumeThread]
ret
Function at 0x10035b60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x10083c3c]
test eax, eax
jne 0x10035bc9
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x10035bc9
push esi
push 0x178
call fcn.1005555b
add esp, 4
test eax, eax
je 0x10035b96
mov ecx, eax
call fcn.1005555b
mov esi, eax
jmp 0x10035b98
xor esi, esi
cmp byte [0x10083c38], 0
jne 0x10035bb2
mov ecx, esi
mov dword [0x10083c3c], esi
call fcn.1001d6f0
mov eax, esi
pop esi
ret
push esi
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, esi
call fcn.1001d6f0
mov eax, esi
pop esi
ret

Function at 0x10035bd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x100829d0]
cmp eax, 0xffffffff
je 0x10035c26
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10035c17
mov ecx, dword [0x10083c3c]
xor eax, eax
cmp esi, ecx
cmove ecx, eax
mov dword [0x10083c3c], ecx
mov ecx, esi
call fcn.1001d720
mov ecx, esi
call fcn.1001d6c0
push 0x178
push esi
call fcn.1005555b
add esp, 8
push 0
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop esi
ret
Function at 0x2fda10cc
Capabilities:
Terminate process

Disassembly:
call 0x2fda10d6
jmp 0x2fda11b3
push 0x58
push 0x2fda12c8
call fcn.2fda12f0
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x2fda3044
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x2fda175b
xor esi, esi
inc esi
mov eax, dword [0x2fda3040]
cmp eax, esi
je 0x2fda1779
mov eax, dword [0x2fda3040]
test eax, eax
jne 0x2fda1568
mov dword [0x2fda3040], esi
push 0x2fda12c0
push 0x2fda12b8
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
jne 0x2fda181b
mov eax, dword [0x2fda3040]
cmp eax, esi
jne 0x2fda125f
push 0x2fda12b4
push 0x2fda12ac
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x2fda3040], 2
test ebx, ebx
jne 0x2fda126b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x2fda3050], 0
jne 0x2fda1786
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
nop
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
jbe 0x2fda1528
cmp al, 0x22
je 0x2fda1518
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
jne 0x2fda17bf
inc esi
jmp 0x2fda1280
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
jmp 0x2fda1295
test al, al
je 0x2fda1536
cmp dword [ebp - 0x1c], 0
jne 0x2fda128d
mov al, byte [esi]
test al, al
je 0x2fda1546
cmp al, 0x20
ja 0x2fda1546
inc esi
mov dword [ebp - 0x20], esi
jmp 0x2fda1536
test byte [ebp - 0x3c], 1
jne 0x2fda1562
push 0xa
pop eax
push eax
push esi
push 0
push 0x2fda0000
call fcn.2fda1573
jmp 0x2fda17aa
movzx eax, word [ebp - 0x38]
jmp 0x2fda154f
mov dword [0x2fda3058], esi
jmp 0x2fda123b
cmp eax, esi
jne 0x2fda1769
xor esi, esi
inc esi
mov ebx, esi
jmp 0x2fda1202
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x2fda11ed
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x2fda123b
push 0x2fda3050
call fcn.2fda1d69
pop ecx
test eax, eax
je 0x2fda1278
push 0
push 2
push 0
call dword [0x2fda3050]
jmp 0x2fda1278
mov dword [0x2fda3054], eax
cmp dword [0x2fda3020], 0
jne 0x2fda17f7
push eax
call dword [sym.imp.MSVCR80.dll_exit]
inc esi
mov dword [ebp - 0x20], esi
jmp 0x2fda12a8
cmp dword [0x2fda3058], 0
jne 0x2fda1806
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x2fda3054]
jmp 0x2fda1827
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.2fda1504
ret
Function at 0x2fda1968
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x2fda1634]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x47c], eax
push 0x105
lea eax, [ebp - 0x260]
xor esi, esi
push eax
mov word [ebp - 0x468], si
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
jne 0x2fda19ab
xor eax, eax
jmp 0x2fda1a75
add eax, eax
lea ecx, [ebp + eax - 0x260]
cmp word [ecx], 0x5c
je 0x2fda19c7
mov word [ecx], 0x5c
mov word [ebp + eax - 0x25e], si
push edi
mov edi, 0x2fda1b9c
push edi
push 0x106
lea eax, [ebp - 0x260]
push eax
call fcn.2fda18d4
push 8
push esi
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp eax, esi
mov dword [ebp - 0x46c], eax
jne 0x2fda1a0a
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, esi
mov dword [ebp - 0x46c], eax
je 0x2fda1a46
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x2fda1b88
push dword [ebp - 0x46c]
call edi
push 0x2fda1b68
push dword [ebp - 0x46c]
mov dword [ebp - 0x474], eax
call edi
cmp eax, esi
mov dword [ebp - 0x478], eax
jne 0x2fda1a4a
push dword [ebp - 0x46c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x2fda1a74
cmp dword [ebp - 0x47c], esi
push ebx
mov ebx, 0x2fda1620
mov edi, 0x2fda1b18
je 0x2fda1aca
cmp dword [ebp - 0x474], esi
jne 0x2fda1a84
push dword [ebp - 0x46c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.2fda1bac
leave
ret 4
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x47c]
call dword [ebp - 0x474]
cmp eax, esi
jne 0x2fda1ac3
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x468]
push eax
push esi
push esi
lea eax, [ebp - 0x54]
push eax
push esi
push ebx
push edi
mov dword [ebp - 0x470], 0x104
call dword [ebp - 0x478]
cmp eax, esi
je 0x2fda1b05
cmp eax, 0x642
je 0x2fda1b05
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x468]
push eax
push esi
push esi
push esi
push esi
push ebx
push edi
mov dword [ebp - 0x470], 0x104
call dword [ebp - 0x478]
test eax, eax
je 0x2fda1b05
push dword [ebp - 0x46c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
jmp 0x2fda1a73
lea eax, [ebp - 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
jmp 0x2fda1af2
Function at 0x2fda1bac
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2fda1634]
jne 0x2fda1bb5
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x2fda3168], eax
mov dword [0x2fda3164], ecx
mov dword [0x2fda3160], edx
mov dword [0x2fda315c], ebx
mov dword [0x2fda3158], esi
mov dword [0x2fda3154], edi
mov word [0x2fda3180], ss
mov word [0x2fda3174], cs
mov word [0x2fda3150], ds
mov word [0x2fda314c], es
mov word [0x2fda3148], fs
mov word [0x2fda3144], gs
pushfd
pop dword [0x2fda3178]
mov eax, dword [ebp]
mov dword [0x2fda316c], eax
mov eax, dword [ebp + 4]
mov dword [0x2fda3170], eax
lea eax, [ebp + 8]
mov dword [0x2fda317c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x2fda30b8], 0x10001
mov eax, dword [0x2fda3170]
mov dword [0x2fda306c], eax
mov dword [0x2fda3060], 0xc0000409
mov dword [0x2fda3064], 1
mov eax, dword [0x2fda1634]
mov dword [ebp - 0x328], eax
mov eax, dword [section..data]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x2fda30b0], eax
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x2fda1cbc
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x2fda30b0], 0
jne 0x2fda1ca5
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret