joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40782d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 8
call fcn.0040a280
xor esi, esi
inc esi
cmp dword [0x417ae8], esi
pop ecx
jne 0x407855
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x417ae4], esi
mov byte [0x417ae0], al
jne 0x4078bb
mov ecx, dword [0x4182a8]
test ecx, ecx
je 0x40789c
mov eax, dword [0x4182a4]
sub eax, 4
cmp eax, ecx
jmp 0x407895
mov eax, dword [eax]
test eax, eax
je 0x407887
call eax
mov eax, dword [0x4182a4]
sub eax, 4
cmp eax, dword [0x4182a8]
mov dword [0x4182a4], eax
jae 0x40787f
mov eax, 0x415030
mov esi, 0x415038
cmp eax, esi
mov edi, eax
jae 0x4078bb
mov eax, dword [edi]
test eax, eax
je 0x4078b4
call eax
add edi, 4
cmp edi, esi
jb 0x4078ac
mov eax, 0x41503c
mov esi, 0x415044
cmp eax, esi
mov edi, eax
jae 0x4078da
mov eax, dword [edi]
test eax, eax
je 0x4078d3
call eax
add edi, 4
cmp edi, esi
jb 0x4078cb
cmp dword [ebp + 0x10], 0
pop edi
pop esi
je 0x4078eb
push 8
call fcn.0040a1ec
jmp 0x4078fd
push dword [ebp + 8]
mov dword [0x417ae8], 1
call fcn.00407786
pop ecx
pop ebp
ret

Function at 0x40963a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x417b0c], ebx
push esi
push edi
jne 0x4096ba
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4096f5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x417b0c], eax
je 0x4096f5
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x417b10], eax
call esi
cmp dword [0x417aa8], 2
mov dword [0x417b14], eax
jne 0x4096ba
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x417b1c], eax
je 0x4096ba
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x417b18], eax
mov eax, dword [0x417b18]
test eax, eax
je 0x4096ff
call eax
test eax, eax
je 0x4096e6
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x417b1c]
test eax, eax
je 0x4096e6
test byte [ebp - 8], 1
jne 0x4096ff
cmp dword [0x417ab4], 4
jb 0x4096f9
or byte [ebp + 0x12], 0x20
jmp 0x40971e
xor eax, eax
jmp 0x40972e
or byte [ebp + 0x12], 4
jmp 0x40971e
mov eax, dword [0x417b10]
test eax, eax
je 0x40971e
call eax
mov ebx, eax
test ebx, ebx
je 0x40971e
mov eax, dword [0x417b14]
test eax, eax
je 0x40971e
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x417b0c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a677
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x416b10]
xor eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x416e00]
je 0x40a6a4
inc eax
cmp eax, 0x12
jb 0x40a695
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x416e00]
jne 0x40a7d8
mov eax, dword [0x417a98]
cmp eax, 1
je 0x40a7b3
cmp eax, edx
jne 0x40a6d4
cmp dword [0x416944], 1
je 0x40a7b3
cmp ecx, 0xfc
je 0x40a7d8
push 0x104
lea eax, [ebp - 0x10c]
push eax
push edx
mov byte [ebp - 8], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40a70d
lea eax, [ebp - 0x10c]
push str._program_name_unknown_
push eax
call fcn.00409830
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push eax
lea edi, [ebp - 0x10c]
call fcn.004097a0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40a74f
lea eax, [ebp - 0x10c]
push eax
call fcn.004097a0
mov edi, eax
lea eax, [ebp - 0x10c]
sub eax, 0x3b
push 3
add edi, eax
push 0x413430
push edi
call fcn.004066e0
add esp, 0x10
push edi
call fcn.004097a0
push dword [esi + 0x416e04]
mov ebx, eax
call fcn.004097a0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00405ce0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00409830
push edi
push ebx
call fcn.00409840
push 0x41342c
push ebx
call fcn.00409840
push dword [esi + 0x416e04]
push ebx
call fcn.00409840
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0040963a
add esp, 0x2c
jmp 0x40a7d8
push edx
lea eax, [ebp + 8]
push eax
lea esi, [esi + 0x416e04]
push dword [esi]
call fcn.004097a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.00409959
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40cb9d
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00405ce0
mov eax, dword [0x416b10]
xor eax, dword [ebp + 4]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.0040bacd
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x40ccc7
push 2
push esi
push dword [ebp + 8]
call fcn.0040bacd
add esp, 0xc
cmp eax, ebx
je 0x40ccc7
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x40cc6a
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x100c]
push esi
push eax
call fcn.0040da30
push 0x8000
push dword [ebp + 8]
call fcn.0040ef98
add esp, 0x14
mov dword [ebp - 0xc], eax
cmp edi, ebx
mov eax, ebx
jge 0x40cc23
mov eax, edi
push eax
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.004074b1
add esp, 0xc
cmp eax, 0xffffffff
je 0x40cc43
sub edi, eax
test edi, edi
jg 0x40cc1b
jmp 0x40cc5b
call fcn.0040770a
cmp dword [eax], 5
jne 0x40cc58
call fcn.00407701
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.0040ef98
pop ecx
pop ecx
jmp 0x40ccb2
jge 0x40ccb2
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040bacd
push dword [ebp + 8]
call fcn.00407016
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x40ccb2
call fcn.00407701
mov dword [eax], 0xd
call fcn.0040770a
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0040bacd
add esp, 0xc
mov eax, esi
pop edi
jmp 0x40ccc9
mov eax, ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
pop ebx
call fcn.00409959
leave
ret
Function at 0x40e563
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.00405ce0
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40e5f8
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x417aa8]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x40e5f8
cmp eax, 1
je 0x40e610
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40e5f8
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x40e5cd
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x40e5f4
xor eax, eax
inc eax
jmp 0x40e62c
cmp esi, ebx
jae 0x40e5fc
xor eax, eax
jmp 0x40e62c
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x417aa8]
jmp 0x40e612
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10025e90
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, edx
call fcn.10025960
mov edx, esi
mov ecx, eax
pop esi
jmp fcn.10025b80

Function at 0x10026530
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov dword [ebp - 8], edx
push ebx
mov ecx, 0x5a4d
mov dword [ebp - 4], eax
push esi
push edi
cmp word [eax], cx
jne 0x10026599
mov esi, dword [eax + 0x3c]
add esi, eax
cmp dword [esi], 0x4550
jne 0x10026599
movzx ebx, word [esi + 6]
xor edi, edi
test ebx, ebx
je 0x10026599
movzx eax, word [esi + 0x14]
add esi, 0x18
add esi, eax
nop dword [eax + eax]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10026575
sub eax, edx
mov ecx, esi
lea edx, [eax + 1]
shr edx, 1
call fcn.1000aa60
cmp eax, 0x4dcaed07
je 0x100265a2
inc edi
add esi, 0x28
cmp edi, ebx
jb 0x10026570
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
pop edi
mov dword [edx], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
mov dword [edx + 4], eax
mov eax, dword [esi + 0x10]
pop esi
mov dword [edx + 8], eax
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10029ac0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060180
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10073098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ecx
mov word [ebp - 0x18], 0x301
mov byte [ebp - 0x16], 5
xor bl, bl
mov byte [ebp - 0x11], bl
cmp bl, 3
jae 0x10029b35
mov dword [ebp - 4], 0
movzx eax, bl
movzx ecx, byte [ebp + eax - 0x18]
call fcn.1001dea0
mov dword [ebp - 4], 0xffffffff
inc bl
jmp 0x10029afa
push 0
cmp dword [ebp - 0x1c], 0
je 0x10029b42
call fcn.10054047
call dword [0x10061040]
int3
Function at 0x10031ec4
Capabilities:
Check os version

Disassembly:
pop ecx
xor al, 0x5a
push ebp
mov ebp, esp
mov ecx, dword fs:[0x30]
cmp word [ecx + 0xa4], 0xa
je 0x10031f10
cmp word [ecx + 0xa4], 6
jne 0x10031f2f
cmp word [ecx + 0xa8], 3
je 0x10031f11
cmp word [ecx + 0xa8], 2
je 0x10031f12
cmp word [ecx + 0xa8], 1
jne 0x10031f2f
cmp word [ecx + 0xac], 0x1db1
je 0x10031f13
jmp 0x10031f2f
inc eax
inc eax
inc eax
mov ecx, 0x10
dec ecx
push dword [ebp + ecx*4 + 8]
jne 0x10031f18
push 0x1003132f
call dword fs:[0xc0]
lea esp, [esp + 4]
mov esp, ebp
pop ebp
ret

Function at 0x1003212d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
cmp word [eax + 0xa4], 6
je 0x1003214f
cmp word [eax + 0xa4], 0xa
je 0x1003218e
jmp 0x1003233d
cmp word [eax + 0xa8], 1
je 0x1003217a
cmp word [eax + 0xa8], 2
je 0x1003229c
cmp word [eax + 0xa8], 3
je 0x100322a3
jmp 0x1003233d
cmp word [eax + 0xac], 0x1db1
je 0x10032292
jmp 0x1003233d
cmp word [eax + 0xac], 0x2800
je 0x100322aa
cmp word [eax + 0xac], 0x295a
je 0x100322b1
cmp word [eax + 0xac], 0x3839
je 0x100322b8
cmp word [eax + 0xac], 0x3ad7
je 0x100322bf
cmp word [eax + 0xac], 0x3fab
je 0x100322c6
cmp word [eax + 0xac], 0x42ee
je 0x100322cd
cmp word [eax + 0xac], 0x4563
je 0x100322d4
cmp word [eax + 0xac], 0x47ba
je 0x100322db
cmp word [eax + 0xac], 0x47bb
je 0x100322e2
cmp word [eax + 0xac], 0x4a61
je 0x100322e9
cmp word [eax + 0xac], 0x4a62
je 0x100322f0
cmp word [eax + 0xac], 0x4a63
je 0x100322f7
cmp word [eax + 0xac], 0x4a64
je 0x100322fe
cmp word [eax + 0xac], 0x4a65
je 0x10032305
cmp word [eax + 0xac], 0x4f7c
je 0x1003230c
cmp word [eax + 0xac], 0x55f0
je 0x10032313
cmp word [eax + 0xac], 0x585d
je 0x1003231a
jmp 0x1003233d
mov eax, 0xa5
jmp 0x10032321
mov eax, 0xaf
jmp 0x10032321
mov eax, 0xb0
jmp 0x10032321
mov eax, 0xb3
jmp 0x10032321
mov eax, 0xb4
jmp 0x10032321
mov eax, 0xb6
jmp 0x10032321
mov eax, 0xb9
jmp 0x10032321
mov eax, 0xba
jmp 0x10032321
mov eax, 0xbb
jmp 0x10032321
mov eax, 0xbc
jmp 0x10032321
mov eax, 0xbd
jmp 0x10032321
mov eax, 0xbd
jmp 0x10032321
mov eax, 0xc1
jmp 0x10032321
mov eax, 0xc1
jmp 0x10032321
mov eax, 0xc1
jmp 0x10032321
mov eax, 0xc1
jmp 0x10032321
mov eax, 0xc1
jmp 0x10032321
mov eax, 0xc4
jmp 0x10032321
mov eax, 0xc5
jmp 0x10032321
mov eax, 0xc7
jmp 0x10032321
mov ecx, 0x10
dec ecx
push dword [ebp + ecx*4 + 8]
jne 0x10032326
push 0x1003173d
call dword fs:[0xc0]
lea esp, [esp + 4]
mov esp, ebp
pop ebp
ret
Function at 0x10032341
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
cmp word [eax + 0xa4], 6
je 0x10032363
cmp word [eax + 0xa4], 0xa
je 0x100323a2
jmp 0x10032551
cmp word [eax + 0xa8], 1
je 0x1003238e
cmp word [eax + 0xa8], 2
je 0x100324b0
cmp word [eax + 0xa8], 3
je 0x100324b7
jmp 0x10032551
cmp word [eax + 0xac], 0x1db1
je 0x100324a6
jmp 0x10032551
cmp word [eax + 0xac], 0x2800
je 0x100324be
cmp word [eax + 0xac], 0x295a
je 0x100324c5
cmp word [eax + 0xac], 0x3839
je 0x100324cc
cmp word [eax + 0xac], 0x3ad7
je 0x100324d3
cmp word [eax + 0xac], 0x3fab
je 0x100324da
cmp word [eax + 0xac], 0x42ee
je 0x100324e1
cmp word [eax + 0xac], 0x4563
je 0x100324e8
cmp word [eax + 0xac], 0x47ba
je 0x100324ef
cmp word [eax + 0xac], 0x47bb
je 0x100324f6
cmp word [eax + 0xac], 0x4a61
je 0x100324fd
cmp word [eax + 0xac], 0x4a62
je 0x10032504
cmp word [eax + 0xac], 0x4a63
je 0x1003250b
cmp word [eax + 0xac], 0x4a64
je 0x10032512
cmp word [eax + 0xac], 0x4a65
je 0x10032519
cmp word [eax + 0xac], 0x4f7c
je 0x10032520
cmp word [eax + 0xac], 0x55f0
je 0x10032527
cmp word [eax + 0xac], 0x585d
je 0x1003252e
jmp 0x10032551
mov eax, 0xaa
jmp 0x10032535
mov eax, 0xb5
jmp 0x10032535
mov eax, 0xb7
jmp 0x10032535
mov eax, 0xba
jmp 0x10032535
mov eax, 0xbb
jmp 0x10032535
mov eax, 0xbd
jmp 0x10032535
mov eax, 0xc0
jmp 0x10032535
mov eax, 0xc1
jmp 0x10032535
mov eax, 0xc2
jmp 0x10032535
mov eax, 0xc3
jmp 0x10032535
mov eax, 0xc4
jmp 0x10032535
mov eax, 0xc4
jmp 0x10032535
mov eax, 0xc8
jmp 0x10032535
mov eax, 0xc8
jmp 0x10032535
mov eax, 0xc8
jmp 0x10032535
mov eax, 0xc8
jmp 0x10032535
mov eax, 0xc8
jmp 0x10032535
mov eax, 0xcc
jmp 0x10032535
mov eax, 0xcd
jmp 0x10032535
mov eax, 0xcf
jmp 0x10032535
mov ecx, 0x10
dec ecx
push dword [ebp + ecx*4 + 8]
jne 0x1003253a
push 0x10031951
call dword fs:[0xc0]
lea esp, [esp + 4]
mov esp, ebp
pop ebp
ret
Function at 0x1003297d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
cmp word [eax + 0xa4], 6
je 0x1003299f
cmp word [eax + 0xa4], 0xa
je 0x100329de
jmp 0x10032b8d
cmp word [eax + 0xa8], 1
je 0x100329ca
cmp word [eax + 0xa8], 2
je 0x10032aec
cmp word [eax + 0xa8], 3
je 0x10032af3
jmp 0x10032b8d
cmp word [eax + 0xac], 0x1db1
je 0x10032ae2
jmp 0x10032b8d
cmp word [eax + 0xac], 0x2800
je 0x10032afa
cmp word [eax + 0xac], 0x295a
je 0x10032b01
cmp word [eax + 0xac], 0x3839
je 0x10032b08
cmp word [eax + 0xac], 0x3ad7
je 0x10032b0f
cmp word [eax + 0xac], 0x3fab
je 0x10032b16
cmp word [eax + 0xac], 0x42ee
je 0x10032b1d
cmp word [eax + 0xac], 0x4563
je 0x10032b24
cmp word [eax + 0xac], 0x47ba
je 0x10032b2b
cmp word [eax + 0xac], 0x47bb
je 0x10032b32
cmp word [eax + 0xac], 0x4a61
je 0x10032b39
cmp word [eax + 0xac], 0x4a62
je 0x10032b40
cmp word [eax + 0xac], 0x4a63
je 0x10032b47
cmp word [eax + 0xac], 0x4a64
je 0x10032b4e
cmp word [eax + 0xac], 0x4a65
je 0x10032b55
cmp word [eax + 0xac], 0x4f7c
je 0x10032b5c
cmp word [eax + 0xac], 0x55f0
je 0x10032b63
cmp word [eax + 0xac], 0x585d
je 0x10032b6a
jmp 0x10032b8d
mov eax, 0xf9
jmp 0x10032b71
mov eax, 0x10b
jmp 0x10032b71
mov eax, 0x10e
jmp 0x10032b71
mov eax, 0x114
jmp 0x10032b71
mov eax, 0x117
jmp 0x10032b71
mov eax, 0x119
jmp 0x10032b71
mov eax, 0x11d
jmp 0x10032b71
mov eax, 0x11f
jmp 0x10032b71
mov eax, 0x121
jmp 0x10032b71
mov eax, 0x122
jmp 0x10032b71
mov eax, 0x123
jmp 0x10032b71
mov eax, 0x123
jmp 0x10032b71
mov eax, pe_nt_image_headers32
jmp 0x10032b71
mov eax, pe_nt_image_headers32
jmp 0x10032b71
mov eax, pe_nt_image_headers32
jmp 0x10032b71
mov eax, pe_nt_image_headers32
jmp 0x10032b71
mov eax, pe_nt_image_headers32
jmp 0x10032b71
mov eax, 0x12d
jmp 0x10032b71
mov eax, 0x12e
jmp 0x10032b71
mov eax, 0x131
jmp 0x10032b71
mov ecx, 0x10
dec ecx
push dword [ebp + ecx*4 + 8]
jne 0x10032b76
push 0x10031f8d
call dword fs:[0xc0]
lea esp, [esp + 4]
mov esp, ebp
pop ebp
ret
Function at 0x10032b91
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
cmp word [eax + 0xa4], 6
je 0x10032bb3
cmp word [eax + 0xa4], 0xa
je 0x10032bf2
jmp 0x10032da1
cmp word [eax + 0xa8], 1
je 0x10032bde
cmp word [eax + 0xa8], 2
je 0x10032d00
cmp word [eax + 0xa8], 3
je 0x10032d07
jmp 0x10032da1
cmp word [eax + 0xac], 0x1db1
je 0x10032cf6
jmp 0x10032da1
cmp word [eax + 0xac], 0x2800
je 0x10032d0e
cmp word [eax + 0xac], 0x295a
je 0x10032d15
cmp word [eax + 0xac], 0x3839
je 0x10032d1c
cmp word [eax + 0xac], 0x3ad7
je 0x10032d23
cmp word [eax + 0xac], 0x3fab
je 0x10032d2a
cmp word [eax + 0xac], 0x42ee
je 0x10032d31
cmp word [eax + 0xac], 0x4563
je 0x10032d38
cmp word [eax + 0xac], 0x47ba
je 0x10032d3f
cmp word [eax + 0xac], 0x47bb
je 0x10032d46
cmp word [eax + 0xac], 0x4a61
je 0x10032d4d
cmp word [eax + 0xac], 0x4a62
je 0x10032d54
cmp word [eax + 0xac], 0x4a63
je 0x10032d5b
cmp word [eax + 0xac], 0x4a64
je 0x10032d62
cmp word [eax + 0xac], 0x4a65
je 0x10032d69
cmp word [eax + 0xac], 0x4f7c
je 0x10032d70
cmp word [eax + 0xac], 0x55f0
je 0x10032d77
cmp word [eax + 0xac], 0x585d
je 0x10032d7e
jmp 0x10032da1
mov eax, 0xb6
jmp 0x10032d85
mov eax, 0xc3
jmp 0x10032d85
mov eax, 0xc5
jmp 0x10032d85
mov eax, 0xc8
jmp 0x10032d85
mov eax, 0xc9
jmp 0x10032d85
mov eax, 0xcb
jmp 0x10032d85
mov eax, 0xce
jmp 0x10032d85
mov eax, 0xcf
jmp 0x10032d85
mov eax, 0xd0
jmp 0x10032d85
mov eax, 0xd1
jmp 0x10032d85
mov eax, 0xd2
jmp 0x10032d85
mov eax, 0xd2
jmp 0x10032d85
mov eax, 0xd6
jmp 0x10032d85
mov eax, 0xd6
jmp 0x10032d85
mov eax, 0xd6
jmp 0x10032d85
mov eax, 0xd6
jmp 0x10032d85
mov eax, 0xd6
jmp 0x10032d85
mov eax, 0xda
jmp 0x10032d85
mov eax, 0xdb
jmp 0x10032d85
mov eax, 0xdd
jmp 0x10032d85
mov ecx, 0x10
dec ecx
push dword [ebp + ecx*4 + 8]
jne 0x10032d8a
push 0x100321a1
call dword fs:[0xc0]
lea esp, [esp + 4]
mov esp, ebp
pop ebp
ret
Function at 0x10032da5
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
cmp word [eax + 0xa4], 6
je 0x10032dc7
cmp word [eax + 0xa4], 0xa
je 0x10032e06
jmp 0x10032fb5
cmp word [eax + 0xa8], 1
je 0x10032df2
cmp word [eax + 0xa8], 2
je 0x10032f14
cmp word [eax + 0xa8], 3
je 0x10032f1b
jmp 0x10032fb5
cmp word [eax + 0xac], 0x1db1
je 0x10032f0a
jmp 0x10032fb5
cmp word [eax + 0xac], 0x2800
je 0x10032f22
cmp word [eax + 0xac], 0x295a
je 0x10032f29
cmp word [eax + 0xac], 0x3839
je 0x10032f30
cmp word [eax + 0xac], 0x3ad7
je 0x10032f37
cmp word [eax + 0xac], 0x3fab
je 0x10032f3e
cmp word [eax + 0xac], 0x42ee
je 0x10032f45
cmp word [eax + 0xac], 0x4563
je 0x10032f4c
cmp word [eax + 0xac], 0x47ba
je 0x10032f53
cmp word [eax + 0xac], 0x47bb
je 0x10032f5a
cmp word [eax + 0xac], 0x4a61
je 0x10032f61
cmp word [eax + 0xac], 0x4a62
je 0x10032f68
cmp word [eax + 0xac], 0x4a63
je 0x10032f6f
cmp word [eax + 0xac], 0x4a64
je 0x10032f76
cmp word [eax + 0xac], 0x4a65
je 0x10032f7d
cmp word [eax + 0xac], 0x4f7c
je 0x10032f84
cmp word [eax + 0xac], 0x55f0
je 0x10032f8b
cmp word [eax + 0xac], 0x585d
je 0x10032f92
jmp 0x10032fb5
mov eax, 0xc2
jmp 0x10032f99
mov eax, 0xd4
jmp 0x10032f99
mov eax, 0xd6
jmp 0x10032f99
mov eax, 0xd9
jmp 0x10032f99
mov eax, 0xda
jmp 0x10032f99
mov eax, 0xdc
jmp 0x10032f99
mov eax, 0xdf
jmp 0x10032f99
mov eax, 0xe0
jmp 0x10032f99
mov eax, 0xe1
jmp 0x10032f99
mov eax, 0xe2
jmp 0x10032f99
mov eax, 0xe3
jmp 0x10032f99
mov eax, 0xe3
jmp 0x10032f99
mov eax, 0xe8
jmp 0x10032f99
mov eax, 0xe8
jmp 0x10032f99
mov eax, 0xe8
jmp 0x10032f99
mov eax, 0xe8
jmp 0x10032f99
mov eax, 0xe8
jmp 0x10032f99
mov eax, 0xec
jmp 0x10032f99
mov eax, 0xed
jmp 0x10032f99
mov eax, 0xef
jmp 0x10032f99
mov ecx, 0x10
dec ecx
push dword [ebp + ecx*4 + 8]
jne 0x10032f9e
push 0x100323b5
call dword fs:[0xc0]
lea esp, [esp + 4]
mov esp, ebp
pop ebp
ret
Function at 0x10033c00
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 0x18]
xor esi, esi
xor edi, edi
xor ebx, ebx
call fcn.10033b80
mov ecx, dword [ebp + 0x14]
mov eax, 0xaaaaaaab
mul ecx
add esp, 4
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
lea eax, [edx*4]
mov dword [ebp - 4], eax
je 0x10033c4a
test byte [ebp + 0x18], 2
jne 0x10033c40
add eax, 4
jmp 0x10033c47
shr ecx, 1
add eax, 2
add eax, ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], eax
ja 0x10033c54
call fcn.10033100
mov eax, dword [ebp + 0x18]
and eax, 4
cmp dword [ebp + 0x14], ebx
jbe 0x10033d3b
xor ecx, ecx
test eax, eax
je 0x10033cd7
nop dword [eax]
mov eax, dword [ebp + 0x10]
add esi, 8
shl ebx, 8
movzx eax, byte [ecx + eax]
inc ecx
add ebx, eax
mov dword [ebp + 0x18], ecx
cmp esi, 6
jb 0x10033cac
sub esi, 6
mov eax, ebx
mov ecx, esi
shr eax, cl
and eax, 0x3f
push eax
call fcn.10033810
mov ecx, dword [ebp + 8]
add esp, 4
mov byte [edi + ecx], al
inc edi
cmp esi, 6
jae 0x10033c88
mov ecx, dword [ebp + 0x18]
cmp ecx, dword [ebp + 0x14]
jb 0x10033c70
test esi, esi
je 0x10033d3b
mov ecx, 6
sub ecx, esi
shl ebx, cl
and ebx, 0x3f
push ebx
call fcn.10033810
mov ebx, dword [ebp + 8]
add esp, 4
mov byte [edi + ebx], al
inc edi
jmp 0x10033d3e
mov eax, dword [ebp + 0x10]
add esi, 8
shl ebx, 8
movzx eax, byte [ecx + eax]
inc ecx
add ebx, eax
mov dword [ebp + 0x18], ecx
cmp esi, 6
jb 0x10033d14
nop
sub esi, 6
mov eax, ebx
mov ecx, esi
shr eax, cl
and eax, 0x3f
push eax
call fcn.100337a0
mov ecx, dword [ebp + 8]
add esp, 4
mov byte [edi + ecx], al
inc edi
cmp esi, 6
jae 0x10033cf0
mov ecx, dword [ebp + 0x18]
cmp ecx, dword [ebp + 0x14]
jb 0x10033cd7
test esi, esi
je 0x10033d3b
mov ecx, 6
sub ecx, esi
shl ebx, cl
and ebx, 0x3f
push ebx
call fcn.100337a0
mov ebx, dword [ebp + 8]
add esp, 4
mov byte [edi + ebx], al
inc edi
jmp 0x10033d3e
mov ebx, dword [ebp + 8]
mov edx, dword [ebp - 4]
cmp edi, edx
jae 0x10033d5c
mov ecx, edi
mov eax, edx
sub eax, edi
mov edi, edx
push eax
push 0x3d
lea eax, [ecx + ebx]
push eax
call fcn.1004d980
add esp, 0xc
mov eax, dword [ebp + 0xc]
nop
mov byte [edi + ebx], 0
inc edi
cmp edi, eax
jb 0x10033d60
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret