joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe18a4a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x10]
bt ecx, ecx
mov dx, 0xa2b8
mov ah, dh
jmp 0xe18a81
push dword [esp + 5]
xchg dword [esp + 0x18], edx
lea eax, [ecx*4]
jmp 0xe19471
mov byte [esp + 3], bl
bsf ax, di
mov byte [esp + 3], al
mov ah, byte [esp + 0x1e]
push word [esp + 8]
bt ecx, ecx
jmp 0xe18a6b
not eax
push word [esp + 9]
pop word [esp + 1]
add esp, 0xc
mov eax, 0xe20213fe
sub esp, 3
jmp 0xe18ab6
rdtsc
neg cx
xchg byte [esp + 4], cl
push dword [esp + 4]
mov dword [esp + 2], ebx
lea eax, reloc.MSVFW32.dll_DrawDibDraw
jmp 0xe18acd
mov byte [esp + 4], dh
pop eax
push dword [esp + 4]
inc ch
setne al
not dh
jmp 0xe18b15
add esp, 0x16
mov word [esp + 7], bp
mov byte [esp + 0xe], dl
pop dword [esp + 1]
add cl, 0xbe
cmc
jmp 0xe18b4c
mov dword [esp + 4], esi
neg cx
xchg word [esp + 0x12], ax
rcr ah, cl
mov dx, word [esp + 0x23]
lea edx, reloc.MSVFW32.dll_DrawDibDraw
jmp 0xe18cf3
mov byte [esp + 0xd], bh
pop dword [esp + 0xd]
push dword [esp + 8]
not eax
rcl ax, 7
mov eax, 0xa4c262c0
jmp 0xe18dfc

Function at 0xe18ca0
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
add esp, 0
rdtsc
jmp 0xe18cdb
mov cx, word [esp + 3]
mov edx, ebx
mov cx, word [esp + 1]
lea edx, [edx + ebp]
jmp 0xe18cc5
Function at 0x4010d0
Capabilities:
Accept command line arguments

Disassembly:
push ecx
lea eax, [esp]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
jne 0x4010f2
mov eax, 0xa
pop esi
pop ecx
ret
cmp dword [esp + 4], 2
jne 0x401115
mov ecx, dword [esi + 4]
push str.Once
push ecx
call fcn.00401720
add esp, 8
test eax, eax
jne 0x401115
mov byte [0x4097b4], 1
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop esi
pop ecx
ret

Function at 0x4014b0
Capabilities:
Create thread

Disassembly:
jmp 0x4014c0
mov eax, dword [0x4097ac]
test eax, eax
je 0x4014dc
push 0x1388
push 0x4097a0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
xor eax, eax
ret
push 0
push 0
push 0
push 0
mov dword [0x4097a0], 0x1388
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [0x4097b0], eax
jne 0x4014fe
ret
push 0x4097a8
push 0
push 0
push 0x4015b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x4097ac], eax
jne 0x401538
mov eax, dword [0x4097b0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4097b0], 0
xor eax, eax
ret
mov eax, 1
ret

Function at 0x401640
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x320
push ebx
push ebp
push esi
push edi
push 0
push str.tooltips_class32
call dword [sym.imp.USER32.dll_FindWindowA]
mov ecx, dword [0x409798]
mov esi, eax
lea eax, [esp + 0x10]
push 0x12c
push eax
push 0x6e
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
test esi, esi
je 0x401708
mov ebp, dword [sym.imp.USER32.dll_IsWindowVisible]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
push esi
call ebp
test eax, eax
je 0x4016c0
lea edx, [esp + 0x13c]
push edx
push 0x1f4
push 0xd
push esi
call edi
lea eax, [esp + 0x10]
push 0x16
lea ecx, [esp + 0x140]
push eax
push ecx
call fcn.004017a0
add esp, 0xc
test eax, eax
je 0x4016d6
push 2
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x40168c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
push 0
push 0
push 0x10
push esi
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
call esi
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x4097b4], 1
jne 0x401708
mov edx, dword [0x40979c]
push 0
push 0
push 2
push edx
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x320
ret
Function at 0x1000e290
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x10036138]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.1000e1cf
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.1000f020
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x1000e2df
cmp dword [ebp - 0x1c], 5
jb 0x1000e2f7
jmp 0x1000e2f3
cmp dword [ebp - 0x10], 1
jne 0x1000e2f7
cmp dword [ebp - 0x1c], 4
ja 0x1000e2f3
jne 0x1000e2f7
cmp dword [ebp - 0x18], 0
jbe 0x1000e2f7
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x1002c33c
call fcn.1000e065
test eax, eax
jge 0x1000e318
mov byte [0x10038b80], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1000e688
add ebp, 0x78
leave
ret

Function at 0x1000e688
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10036138]
jne 0x1000e692
repz ret
jmp fcn.1001606c
Function at 0x10016a98
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10036300]
je 0x10016ab3
inc edi
cmp edi, 0x17
jb 0x10016aa4
cmp edi, 0x17
jae 0x10016c33
push ebp
push 3
call fcn.1001e5cf
cmp eax, 1
pop ecx
je 0x10016bff
push 3
call fcn.1001e5cf
test eax, eax
pop ecx
jne 0x10016ae7
cmp dword [0x10037d78], 1
je 0x10016bff
cmp ebx, 0xfc
je 0x10016c32
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x10038120
push ebp
call fcn.100162c0
add esp, 0xc
test eax, eax
je 0x10016b1d
push esi
push esi
push esi
push esi
push esi
call fcn.1000e935
add esp, 0x14
push 0x104
mov esi, 0x10038139
push esi
push 0
mov byte [0x1003823d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10016b61
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.100162c0
add esp, 0xc
test eax, eax
je 0x10016b61
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1000e935
add esp, 0x14
push esi
call fcn.1000e8a0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10016ba6
push esi
call fcn.1000e8a0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x10038434
push 0x1002d3a4
sub ecx, eax
push ecx
push eax
call fcn.1001bfd1
add esp, 0x14
test eax, eax
je 0x10016ba6
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1000e935
add esp, 0x14
jmp 0x10016ba8
xor esi, esi
push 0x1002d3a0
push ebx
push ebp
call fcn.1001bf60
add esp, 0xc
test eax, eax
je 0x10016bc8
push esi
push esi
push esi
push esi
push esi
call fcn.1000e935
add esp, 0x14
push dword [edi*8 + 0x10036304]
push ebx
push ebp
call fcn.1001bf60
add esp, 0xc
test eax, eax
je 0x10016bea
push esi
push esi
push esi
push esi
push esi
call fcn.1000e935
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.1001e412
add esp, 0xc
jmp 0x10016c32
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x10016c32
cmp ebp, 0xffffffff
je 0x10016c32
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x10036304]
push dword [esi]
call fcn.1000e8a0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x1001e412
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10016519
xor ebx, ebx
cmp dword [0x1003875c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x1001e4e8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1001e5c8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x1001e5c8
push eax
call fcn.100164ab
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1003875c], eax
call esi
push eax
call fcn.100164ab
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10038760], eax
call esi
push eax
call fcn.100164ab
mov dword [0x10038764], eax
lea eax, [ebp - 0xc]
push eax
call fcn.10012f13
test eax, eax
pop ecx
pop ecx
je 0x1001e4b6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1000e935
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x1001e4e8
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.100164ab
cmp eax, ebx
pop ecx
mov dword [0x1003876c], eax
je 0x1001e4e8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100164ab
pop ecx
mov dword [0x10038768], eax
mov eax, dword [0x10038768]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x1001e56d
cmp dword [0x1003876c], ecx
je 0x1001e56d
push eax
call fcn.10016522
push dword [0x1003876c]
mov esi, eax
call fcn.10016522
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x1001e56d
cmp edi, ebx
je 0x1001e56d
call esi
cmp eax, ebx
je 0x1001e53a
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001e53a
test byte [ebp - 0x18], 1
jne 0x1001e56d
lea eax, [ebp - 0x10]
push eax
call fcn.10012f4a
test eax, eax
pop ecx
je 0x1001e555
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1000e935
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x1001e564
or dword [ebp + 0x10], 0x200000
jmp 0x1001e5a8
or dword [ebp + 0x10], 0x40000
jmp 0x1001e5a8
mov eax, dword [0x10038760]
cmp eax, dword [ebp - 8]
je 0x1001e5a8
push eax
call fcn.10016522
cmp eax, ebx
pop ecx
je 0x1001e5a8
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1001e5a8
mov eax, dword [0x10038764]
cmp eax, dword [ebp - 8]
je 0x1001e5a8
push eax
call fcn.10016522
cmp eax, ebx
pop ecx
je 0x1001e5a8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1003875c]
call fcn.10016522
cmp eax, ebx
pop ecx
je 0x1001e5c8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001e5ca
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10025150
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 4]
mov dword [edx], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x100262a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x10036138]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x220], ecx
mov dword [ebp - 4], 0x100303cc
mov dword [ebp - 0xc], 0x100303fc
mov dword [ebp - 0x21c], 0x100
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10026349
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10026339
lea ecx, [ebp - 0x218]
push ecx
push 0x10030414
mov edx, dword [ebp + 8]
push edx
call fcn.10006320
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10026347
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10026352
jmp 0x1002634d
xor eax, eax
jmp 0x10026352
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000e688
mov esp, ebp
pop ebp
ret 4
Function at 0x10027190
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x10036138]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x74], 0
jmp 0x100271bc
mov eax, dword [ebp - 0x74]
add eax, 1
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x37
jge 0x100271cd
mov ecx, dword [ebp - 0x6c]
add ecx, dword [ebp - 0x74]
mov dword [ebp - 0x6c], ecx
jmp 0x100271b3
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
add eax, dword [ebp - 0x6c]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0
push 0x5f
push 0
lea edx, [ebp - 0x67]
push edx
call fcn.1000f020
add esp, 0xc
push 0x60
push 0x18
lea eax, [ebp - 0x68]
push eax
call fcn.1000f020
add esp, 0xc
push 0x258
call fcn.1000d668
add esp, 4
mov dword [ebp - 0xc8], eax
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0x70], ecx
push 0x258
push 0x18
mov edx, dword [ebp - 0x70]
push edx
call fcn.1000f020
add esp, 0xc
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xcc], eax
mov ecx, dword [ebp - 0xcc]
push ecx
call fcn.1000e697
add esp, 4
mov dword [ebp - 0x78], 1
mov edx, dword [ebp - 0x78]
add edx, 1
mov dword [ebp - 0x78], edx
mov eax, dword [ebp - 0x78]
add eax, 7
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x80], 1
mov ecx, dword [ebp - 0x80]
add ecx, 1
mov dword [ebp - 0x80], ecx
mov edx, dword [ebp - 0x80]
add edx, 7
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x88], 1
mov eax, dword [ebp - 0x88]
add eax, 1
mov dword [ebp - 0x88], eax
mov ecx, dword [ebp - 0x88]
add ecx, 7
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x90], 1
mov edx, dword [ebp - 0x90]
add edx, 1
mov dword [ebp - 0x90], edx
mov eax, dword [ebp - 0x90]
add eax, 7
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x98], 1
mov ecx, dword [ebp - 0x98]
add ecx, 1
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x98]
add edx, 7
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0xa0], 1
mov eax, dword [ebp - 0xa0]
add eax, 1
mov dword [ebp - 0xa0], eax
mov ecx, dword [ebp - 0xa0]
add ecx, 7
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xa8], 1
mov edx, dword [ebp - 0xa8]
add edx, 1
mov dword [ebp - 0xa8], edx
mov eax, dword [ebp - 0xa8]
add eax, 7
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xb0], 1
mov ecx, dword [ebp - 0xb0]
add ecx, 1
mov dword [ebp - 0xb0], ecx
mov edx, dword [ebp - 0xb0]
add edx, 7
mov dword [ebp - 0xb4], edx
mov dword [ebp - 0xb8], 1
mov eax, dword [ebp - 0xb8]
add eax, 1
mov dword [ebp - 0xb8], eax
mov ecx, dword [ebp - 0xb8]
add ecx, 7
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0xc0], 1
mov edx, dword [ebp - 0xc0]
add edx, 1
mov dword [ebp - 0xc0], edx
mov eax, dword [ebp - 0xc0]
add eax, 7
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000e688
mov esp, ebp
pop ebp
ret
Function at 0x10027bd0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x10036138]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x5c], 0
jmp 0x10027bfc
mov eax, dword [ebp - 0x5c]
add eax, 1
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x22
jge 0x10027c0d
mov ecx, dword [ebp - 0x54]
add ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x54], ecx
jmp 0x10027bf3
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
add eax, dword [ebp - 0x54]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0
push 0x43
push 0
lea edx, [ebp - 0x4f]
push edx
call fcn.1000f020
add esp, 0xc
push 0x44
push 0x89
lea eax, [ebp - 0x50]
push eax
call fcn.1000f020
add esp, 0xc
push 0x3b8
call fcn.1000d668
add esp, 4
mov dword [ebp - 0xb0], eax
mov ecx, dword [ebp - 0xb0]
mov dword [ebp - 0x58], ecx
push 0x3b8
push 0x89
mov edx, dword [ebp - 0x58]
push edx
call fcn.1000f020
add esp, 0xc
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xb4], eax
mov ecx, dword [ebp - 0xb4]
push ecx
call fcn.1000e697
add esp, 4
mov dword [ebp - 0x60], 1
mov edx, dword [ebp - 0x60]
add edx, 1
mov dword [ebp - 0x60], edx
mov eax, dword [ebp - 0x60]
add eax, 2
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x68], 1
mov ecx, dword [ebp - 0x68]
add ecx, 1
mov dword [ebp - 0x68], ecx
mov edx, dword [ebp - 0x68]
add edx, 2
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x70], 1
mov eax, dword [ebp - 0x70]
add eax, 1
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
add ecx, 2
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], 1
mov edx, dword [ebp - 0x78]
add edx, 1
mov dword [ebp - 0x78], edx
mov eax, dword [ebp - 0x78]
add eax, 2
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x80], 1
mov ecx, dword [ebp - 0x80]
add ecx, 1
mov dword [ebp - 0x80], ecx
mov edx, dword [ebp - 0x80]
add edx, 2
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x88], 1
mov eax, dword [ebp - 0x88]
add eax, 1
mov dword [ebp - 0x88], eax
mov ecx, dword [ebp - 0x88]
add ecx, 2
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x90], 1
mov edx, dword [ebp - 0x90]
add edx, 1
mov dword [ebp - 0x90], edx
mov eax, dword [ebp - 0x90]
add eax, 2
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x98], 1
mov ecx, dword [ebp - 0x98]
add ecx, 1
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x98]
add edx, 2
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0xa0], 1
mov eax, dword [ebp - 0xa0]
add eax, 1
mov dword [ebp - 0xa0], eax
mov ecx, dword [ebp - 0xa0]
add ecx, 2
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xa8], 1
mov edx, dword [ebp - 0xa8]
add edx, 1
mov dword [ebp - 0xa8], edx
mov eax, dword [ebp - 0xa8]
add eax, 2
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000e688
mov esp, ebp
pop ebp
ret
Function at 0x10028000
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x10036138]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], 0
jmp 0x1002802c
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x36
jge 0x1002803d
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
jmp 0x10028023
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
xor edx, edx
mov dword [ebp - 0x1f], edx
mov dword [ebp - 0x1b], edx
mov dword [ebp - 0x17], edx
mov dword [ebp - 0x13], edx
mov dword [ebp - 0xf], edx
mov dword [ebp - 0xb], edx
mov word [ebp - 7], dx
mov byte [ebp - 5], dl
push 0x1c
push 0x64
lea eax, [ebp - 0x20]
push eax
call fcn.1000f020
add esp, 0xc
push 0x170
call fcn.1000d668
add esp, 4
mov dword [ebp - 0x80], eax
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x28], ecx
push 0x170
push 0x64
mov edx, dword [ebp - 0x28]
push edx
call fcn.1000f020
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x84], eax
mov ecx, dword [ebp - 0x84]
push ecx
call fcn.1000e697
add esp, 4
mov dword [ebp - 0x30], 1
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
add eax, 3
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 1
mov ecx, dword [ebp - 0x38]
add ecx, 1
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x38]
add edx, 3
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], 1
mov eax, dword [ebp - 0x40]
add eax, 1
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
add ecx, 3
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], 1
mov edx, dword [ebp - 0x48]
add edx, 1
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
add eax, 3
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], 1
mov ecx, dword [ebp - 0x50]
add ecx, 1
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x50]
add edx, 3
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x58], 1
mov eax, dword [ebp - 0x58]
add eax, 1
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
add ecx, 3
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], 1
mov edx, dword [ebp - 0x60]
add edx, 1
mov dword [ebp - 0x60], edx
mov eax, dword [ebp - 0x60]
add eax, 3
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x68], 1
mov ecx, dword [ebp - 0x68]
add ecx, 1
mov dword [ebp - 0x68], ecx
mov edx, dword [ebp - 0x68]
add edx, 3
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x70], 1
mov eax, dword [ebp - 0x70]
add eax, 1
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
add ecx, 3
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], 1
mov edx, dword [ebp - 0x78]
add edx, 1
mov dword [ebp - 0x78], edx
mov eax, dword [ebp - 0x78]
add eax, 3
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000e688
mov esp, ebp
pop ebp
ret
Function at 0x10028410
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x10028442
xor eax, eax
jmp 0x100284da
mov dword [ebp - 8], 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1002846c
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x100284da
mov dword [ebp - 0x10], 0
cmp dword [ebp - 8], 0
jbe 0x100284cb
push 0
lea eax, [ebp - 4]
push eax
push 4
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x10]
xor eax, 0x78338e37
mov dword [ebp - 0x10], eax
push 1
push 0
push 0xfffffffffffffffc
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x14]
push edx
push 4
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 8]
sub edx, 4
mov dword [ebp - 8], edx
jmp 0x10028473
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10028670
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call fcn.10027190
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov byte [ebp - 0xc], 0
mov dword [ebp - 8], 1
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0x100284e0
push 0
push 0
call fcn.1000f194
add esp, 0x18
mov dword [ebp - 4], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx ecx, byte [ebp - 0xc]
test ecx, ecx
jne 0x1002873c
mov dword [ebp - 8], 0
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0x100284e0
push 0
push 0
call fcn.1000f194
add esp, 0x18
mov dword [ebp - 0x18], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx ecx, byte [ebp - 0xc]
test ecx, ecx
jne 0x10028732
mov dword [ebp - 8], 1
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0x100284e0
push 0
push 0
call fcn.1000f194
add esp, 0x18
mov dword [ebp - 0x1c], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0xc]
mov esp, ebp
pop ebp
ret