joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c13b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dc97a
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10145188]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call dword [sym.imp.Configuration.dll_class_cm_configuration::ConfigurationManager____cdecl_cm_configuration::GetConfigurationManager_void_]
mov ecx, eax
call dword [sym.imp.Configuration.dll_public:_enum_RCD_PRODUCT_MODE___thiscall_cm_configuration::ConfigurationManager::get_rcd_mode_void_]
cmp eax, 2
je 0x100c14dd
push 0xffffffffffffffff
xor ebx, ebx
push ebx
lea ecx, [esi + 0x5fc]
call dword [sym.imp.mfc100u.dll_CStringArray::SetSize]
lea ecx, [ebp - 0x30]
mov dword [esi + 0x668], 1
call dword [0x100ec970]
lea eax, [ebp - 0x34]
push ebx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.Common.dll_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______cdecl_COMMON::GetAppPath_int_]
mov byte [ebp - 4], 1
mov ecx, dword [eax]
push str.DisconectNetDisk.bat
push ecx
lea edx, [ebp - 0x30]
push str.cmd__c___s_s_
push edx
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
add esp, 0x18
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov eax, dword [ebp - 0x30]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.Common.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_CMTool::StringUnicodeToAnsi_wchar_t_const__]
add esp, 8
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2c]
mov esi, 0x10
cmp dword [ebp - 0x18], esi
jae 0x100c1474
lea eax, [ebp - 0x2c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
jbe 0x100c1493
push str.winexec_dismountnetdisk_succ
push 1
call dword [sym.imp.Common.dll_int___cdecl_COMMON::WriteLog_int__wchar_t_const__]
add esp, 8
jmp 0x100c14aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.winexec_dismountnetdisk_false_err__d
push 1
call dword [sym.imp.Common.dll_int___cdecl_COMMON::WriteLog_int__wchar_t_const__]
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x18], esi
jb 0x100c14c7
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.mfc100u.dll_delete_1]
add esp, 4
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d0962
mov esp, ebp
pop ebp
ret
Function at 0x100c1e70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100de529
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x10145188]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x10]
call dword [0x100ec970]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.Common.dll_unsigned_long_int___cdecl_COMMON::GetOSVersion_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____]
add esp, 4
push esi
push 0x101174b8
mov edi, 1
push edi
call dword [sym.imp.Common.dll_int___cdecl_COMMON::WriteLog_int__wchar_t_const__]
add esp, 0xc
push str.Windows_Vista
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CompareNoCase]
test eax, eax
je 0x100c1f2a
push str.Windows_7
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CompareNoCase]
test eax, eax
je 0x100c1f2a
push 0x38
lea ecx, [ebp - 0x48]
push 0
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [ebp - 0x4c]
push edx
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x40], str.open
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x38], str._loginTypeB
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x100c1fba
push 0x38
lea eax, [ebp - 0x48]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x4c]
push ecx
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x40], str.runas
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x38], str._loginTypeB
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x100c1fba
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
jne 0x100c1fba
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x20]
call dword [sym.imp.DuiLib_u.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::GetHWND_void_const]
mov esi, dword [sym.imp.DuiLib_u.dll_public:_static_wchar_t_const____cdecl_DuiLib::CPaintManagerUI::GetStringById_wchar_t_const__]
push str.Messagebox_32
mov ebx, eax
call esi
add esp, 4
push 0
push ebx
push str.Common_3
mov edi, eax
call esi
add esp, 4
push str.Common_9
mov dword [ebp + 8], eax
call esi
mov edx, dword [ebp + 8]
add esp, 4
push eax
xor ebx, ebx
mov ecx, edi
call fcn.100031f0
add esp, 0xc
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100c3680
Capabilities:
Get hostname
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x10145188]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
call fcn.100bc7c0
mov ebx, dword [sym.imp.Common.dll_int___cdecl_COMMON::WriteLog_int__wchar_t_const__]
mov esi, eax
push esi
push str.FixOfficeStar__d
push 1
call ebx
add esp, 0xc
cmp esi, 0xe
jg 0x100c36d0
push 0x10117914
push 1
call ebx
add esp, 8
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d0962
mov esp, ebp
pop ebp
ret
push 0xff
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x100c3703
push str.FixOfficeStar_gethostname_faile.
push 1
call ebx
add esp, 8
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d0962
mov esp, ebp
pop ebp
ret
push edi
cmp esi, 0xf
jne 0x100c3727
lea ecx, [ebp - 0x104]
push ecx
lea ecx, [ebp - 0x108]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov edx, dword [eax]
push edx
push esi
push str.SoftwareMicrosoftOffice_d.0Registration_s91150000_0011_0000_0000_0000000FF1CEEULA
jmp 0x100c374c
cmp esi, 0x10
jne 0x100c380f
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x108]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov ecx, dword [eax]
push ecx
push esi
push str.SoftwareMicrosoftOffice_d.0Registration_s90160000_000F_0000_0000_0000000FF1CEProPlusVolumeEULA
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push 0x10149358
call edi
add esp, 0x10
lea ecx, [ebp - 0x108]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
push esi
push str.SoftwareMicrosoftOffice_d.0
push 0x10148b58
call edi
add esp, 0xc
push 0x10148b54
push 0xf003f
push 0
push 0x10148b58
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100c37a0
push esi
push str.FixOfficeStar
jmp 0x100c37eb
push 0x10148b54
push 0x10149358
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x100c37c1
push eax
push str.FixOfficeStar_RegCreateKey__d.
jmp 0x100c37eb
mov edx, dword [0x10148b54]
push 0x13c
push 0x10115e78
push 1
push 0
push 0x101160fc
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100c37f2
push eax
push str.FixOfficeStar_RegSetValueExW__d.
push 1
call ebx
add esp, 0xc
mov eax, dword [0x10148b54]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d0962
mov esp, ebp
pop ebp
ret
push esi
push 0x10117b10
push 1
call ebx
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100d0962
mov esp, ebp
pop ebp
ret
Function at 0x100c4120
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d27a2
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10145188]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.Common.dll_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______cdecl_COMMON::GetAppPath_int_]
add esp, 8
push str.HaloHalo.exe
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [0x100ec930]
mov ecx, dword [ebp - 0x10]
push ecx
push str.open_halo:_s_.
push 1
call dword [sym.imp.Common.dll_int___cdecl_COMMON::WriteLog_int__wchar_t_const__]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
add esp, 0xc
push 1
push 0
push edx
push eax
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x100c41c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d858a
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x10145188]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x60]
call dword [0x100ec970]
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 4], 0
call fcn.1000ff50
lea ecx, [ebp - 0x5c]
push ecx
push 0x16
mov byte [ebp - 4], 1
call dword [sym.imp.RJDataBase.dll_int___cdecl_RJCDATABASE::cm_tch_get_class_info_unsigned_int__long_int_]
mov edx, dword [ebp - 0x58]
push edx
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.Common.dll_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______cdecl_COMMON::ConvertIP_unsigned_int_]
mov byte [ebp - 4], 2
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x60]
push str.http:___s
push edx
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
add esp, 0x1c
lea ecx, [ebp - 0x64]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov eax, dword [ebp - 0x60]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x1000ff00
push 2
push 0x1c
lea ecx, [ebp - 0x48]
push ecx
mov byte [ebp - 4], 0
call fcn.100d0ae6
lea ecx, [ebp - 0x4c]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
lea ecx, [ebp - 0x60]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d0962
mov esp, ebp
pop ebp
ret
Function at 0x100c4f20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101489d4]
push ebx
push esi
mov esi, eax
cmp dword [esi + 0xbc], 0
push edi
je 0x100c5009
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x100c4f5a
cmp byte [ebp + 8], 0
sete bl
call fcn.10014000
mov eax, dword [esi + 0x78]
call fcn.10011310
mov eax, dword [0x101489d4]
cmp byte [ebp + 8], 0
je 0x100c4fbb
cmp dword [eax + 0x54], 1
jne 0x100c4f6b
mov ecx, dword [eax + 0x20]
jmp 0x100c4f6e
mov ecx, dword [eax + 0x28]
call dword [sym.imp.DuiLib_u.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::GetHWND_void_const]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [esi + 0xbc]
call fcn.100b7560
mov ecx, dword [esi + 0xbc]
call fcn.100b7690
mov edi, dword [esi + 0xbc]
mov dword [esi + 0x24], edi
call fcn.100b6b00
push 1
push 1
mov ecx, edi
call dword [sym.imp.DuiLib_u.dll_public:_void___thiscall_DuiLib::CWindowWnd::ShowWindow_bool__bool_]
mov ecx, edi
call fcn.100b65b0
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, dword [esi + 0xbc]
test ecx, ecx
je 0x100c4fcf
push 1
push 0
call dword [sym.imp.DuiLib_u.dll_public:_void___thiscall_DuiLib::CWindowWnd::ShowWindow_bool__bool_]
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + 0x48c]
call fcn.10062f40
mov ecx, dword [esi + 0x20]
push 5
mov dword [esi + 0x24], ecx
call dword [sym.imp.DuiLib_u.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::GetHWND_void_const]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x20]
mov edx, dword [ecx + 0x5b8]
push 0
push edx
push 0x112
call dword [sym.imp.DuiLib_u.dll_public:_long_int___thiscall_DuiLib::CWindowWnd::SendMessageW_unsigned_int__unsigned_int__long_int_]
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100c5270
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0x101489d4]
push edi
cmp ecx, 6
jge 0x100c5306
mov eax, 1
shl eax, cl
cdq
mov edi, eax
movzx eax, byte [ebp + 8]
shl eax, cl
mov ebx, edx
not edi
and edi, dword [esi + 0x658]
cdq
not ebx
and ebx, dword [esi + 0x65c]
or edi, eax
or ebx, edx
mov eax, edi
or eax, ebx
mov dword [esi + 0x658], edi
mov dword [esi + 0x65c], ebx
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
jne 0x100c52da
push eax
push eax
push str.Shell_TrayWnd
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
push 0
jmp 0x100c52f0
push 5
push 0
push str.Shell_TrayWnd
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
push 5
push str.BasicFunciton_95
call dword [sym.imp.DuiLib_u.dll_public:_static_wchar_t_const____cdecl_DuiLib::CPaintManagerUI::GetStringById_wchar_t_const__]
add esp, 4
push eax
push 0
call esi
push eax
call edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x100c5930
Capabilities:
Terminate process

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
ret

Function at 0x100c60e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x101489d8], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, eax
je 0x100c61c1
lea eax, [ebp + 8]
call fcn.100c70d0
push 0
mov dword [eax], esi
mov eax, dword [0x10145304]
push eax
push 0
push edi
push 0
push 0
push 0
push SysReAllocString
push 0x80880000
push 0
push str.PerryShadowWnd
push 0x80020
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 4], eax
mov eax, dword [0x101489dc]
mov byte [esi + 0xc], 1
mov dword [ebp - 4], 0
test eax, eax
je 0x100c614f
lea ecx, [ebp - 4]
push ecx
call eax
and byte [esi + 0xc], 9
mov al, byte [esi + 0xc]
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 1
je 0x100c6184
test al, 8
jne 0x100c6184
push 0xfffffffffffffff0
push edi
call ebx
test eax, 0x10000000
je 0x100c6184
or byte [esi + 0xc], 4
mov cl, byte [esi + 0xc]
test eax, 0x21000000
jne 0x100c6184
or cl, 2
mov byte [esi + 0xc], cl
test byte [esi + 0xc], 2
je 0x100c619f
mov edx, dword [esi + 4]
push 8
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, edi
call fcn.100c6490
jmp 0x100c61ab
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xfffffffffffffffc
push edi
call ebx
push 0x100c61d0
push 0xfffffffffffffffc
push edi
mov dword [esi + 8], eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100c7050
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
and byte [esi + 0xc], 9
mov al, byte [esi + 0xc]
test al, 1
je 0x100c7094
test al, 8
jne 0x100c7094
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
cmp dword [ebp + 8], 0
je 0x100c7079
mov eax, 0x96000000
test eax, 0x10000000
je 0x100c7094
or byte [esi + 0xc], 4
mov cl, byte [esi + 0xc]
test eax, 0x21000000
jne 0x100c7094
or cl, 2
mov byte [esi + 0xc], cl
test byte [esi + 0xc], 2
je 0x100c70b2
mov eax, dword [esi + 4]
push 8
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, edi
call fcn.100c6490
pop esi
pop ebp
ret 4
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 4
Function at 0x100c9690
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d1d0a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10145188]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
xor ebx, ebx
mov dword [esi], ebx
push 8
mov dword [ebp - 4], ebx
call sub.mfc100u.dll_new
add esp, 4
cmp eax, ebx
je 0x100c9783
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [eax], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea edi, [esi + 0x18]
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], edi
mov dword [edi], ebx
push 8
mov byte [ebp - 4], 2
call sub.mfc100u.dll_new
add esp, 4
cmp eax, ebx
je 0x100c975e
mov dword [edi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [edi]
mov dword [ecx], edi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov eax, 0xf
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], ebx
mov byte [esi + 0x30], bl
mov dword [esi + 0x74], eax
mov dword [esi + 0x70], ebx
mov byte [esi + 0x60], bl
mov word [esi + 0x7c], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x10122018
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], vtable.std::bad_alloc.0
call sub.MSVCR100.dll__CxxThrowException
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x10122018
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x24], vtable.std::bad_alloc.0
call sub.MSVCR100.dll__CxxThrowException
int3

Function at 0x100d0962
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10145188]
jne 0x100d096c
repz ret
jmp fcn.100d1118
Function at 0x25814460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x2581446f
pop dword [ebp - 0x4c]
mov eax, 0xaa748c21
add eax, 0x7b0cb84e
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xb8d5fbc4
sub dword [ebp - 0x5c], 0x6a83b679
mov dword [ebp - 0x58], 0xdcf1eb2
add dword [ebp - 0x58], 0x24642d93
mov dword [ebp - 0x54], 0x4ede800c
add dword [ebp - 0x54], 0xfd6dc422
mov dword [ebp - 0x50], 0x7cc0aa22
sub dword [ebp - 0x50], 0x7cc0aa22
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x6d778336
sub eax, 0x47f5b2f2
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x439a529f
add dword [ebp - 0x5c], 0x30d816b7
mov dword [ebp - 0x58], 0xb39f857c
sub dword [ebp - 0x58], 0x72332407
mov dword [ebp - 0x54], 0xeb0596a9
sub dword [ebp - 0x54], 0x87962a3d
mov dword [ebp - 0x50], 0xa5919e40
sub dword [ebp - 0x50], 0xa5919e40
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3e675
push 0
call eax
mov ecx, 0x84573696
sub ecx, 0x8456e72a
mov edx, eax
mov esi, 0x86e6bf4c
add esi, 0x9e9bd6b4
add esi, dword [ebp - 0x4c]
mov ebx, 0xf246e51c
add dword [ebp - 0x2c], edi
mov edi, dword [esi]
xor dword [ebp - 0x38], edx
sub edi, ebx
xor dword [ebp - 4], edx
mov dword [edx], edi
sub dword [ebp - 0x20], 0xef451b9c
add edx, 0xaa3b7dff
sub edx, 0xaa3b7dfb
add esi, 0x98fb8b7a
sub esi, 0x98fb8b76
loop 0x25814586
add eax, 0xb2bd642b
sub eax, 0xb2bc33a8
xor ebx, ebx
add ebx, eax
add eax, 0xf4d7e31a
add eax, 0xb281ceb
mov ecx, 0x25800000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x10002910
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b9908
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x100fc03c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
mov eax, 0x100fc950
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], eax
nop
mov esi, dword [eax]
lea ecx, [ebp - 0x2c]
push edx
call fcn.10002dc0
push 1
push 0x100db7c4
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.10002ff0
mov ecx, esi
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x10002976
sub ecx, edi
sar ecx, 1
push ecx
push esi
mov ecx, eax
call fcn.10002ff0
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push 0
cmovae eax, dword [ebp - 0x2c]
push 0x8000000
push 3
push 0
push 7
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 4
push 0x1000
push 0x100000
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x10002a16
push 0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push eax
push 0x100000
push esi
push edi
call ebx
test eax, eax
je 0x10002a01
cmp dword [ebp - 0x30], 0
jbe 0x10002a01
push 0
lea eax, [ebp - 0x30]
push eax
push 0x100000
push esi
push edi
call ebx
test eax, eax
jne 0x100029e8
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x10002a53
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10002a49
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002a89
push edx
push ecx
call fcn.10088fde
add esp, 8
mov eax, dword [ebp - 0x34]
add eax, 4
mov dword [ebp - 0x34], eax
cmp eax, 0x100fc97c
je 0x10002a6b
mov edx, dword [ebp - 0x38]
jmp 0x10002950
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10088f98
mov esp, ebp
pop ebp
ret 4
call fcn.100907c4
int3