joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10194380
Capabilities:
Parse pe header

Disassembly:
jmp 0x10194380
sub esp, 0x10
mov eax, dword [0x10205ac8]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x1019452d
cmp esi, 0xffffffff
je 0x1019452d
push 0x400
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10194512
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x10194512
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x10194512
movzx ecx, word [eax + 0x18]
mov edx, 0x10b
push edi
cmp dx, cx
jne 0x101943f5
mov ecx, 0x78
lea edi, [ecx + eax]
jmp 0x1019440b
mov edx, 0x20b
cmp dx, cx
jne 0x10194409
mov ecx, 0x88
lea edi, [ecx + eax]
jmp 0x1019440b
xor edi, edi
push ebp
mov ebp, dword [edi]
test ebp, ebp
je 0x101944f5
cmp dword [edi + 4], 0
je 0x101944f5
mov eax, dword [esi + ebp + 0x1c]
add eax, esi
mov dword [esp + 0x14], eax
test ebx, 0xffff0000
jne 0x1019443c
sub bx, word [esi + ebp + 0x10]
movzx ecx, bx
jmp 0x101944a0
mov eax, dword [esi + ebp + 0x20]
push esi
push 0x10194060
push 4
push dword [esi + ebp + 0x18]
add eax, esi
push eax
push ebx
mov dword [esp + 0x28], eax
call fcn.101c64c9
mov ecx, eax
add esp, 0x18
test ecx, ecx
jne 0x1019448a
mov eax, dword [esi + ebp + 0x18]
push esi
push 0x10194060
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push 4
push eax
push dword [esp + 0x20]
push ebx
call fcn.101c6598
mov ecx, eax
add esp, 0x18
test ecx, ecx
je 0x101944f5
sub ecx, dword [esp + 0x10]
mov eax, dword [esi + ebp + 0x24]
shr ecx, 2
lea eax, [eax + ecx*2]
movzx ecx, word [eax + esi]
mov eax, dword [esp + 0x14]
movzx ecx, cx
cmp ecx, dword [esi + ebp + 0x14]
jae 0x101944f5
mov ecx, dword [eax + ecx*4]
mov edx, dword [edi]
cmp ecx, edx
jb 0x101944df
mov eax, dword [edi + 4]
add eax, edx
cmp ecx, eax
jae 0x101944df
lea eax, [ecx + esi]
push eax
push esi
call fcn.101940c0
add esp, 8
test eax, eax
je 0x101944f5
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.101b4a00
add esp, 0x10
ret
pop ebp
pop edi
lea eax, [ecx + esi]
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.101b4a00
add esp, 0x10
ret
push 0x7f
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.101b4a00
add esp, 0x10
ret
push 0x7e
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.101b4a00
add esp, 0x10
ret
push 0x7f
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x14]
xor eax, eax
pop esi
pop ebx
xor ecx, esp
call fcn.101b4a00
add esp, 0x10
ret
Function at 0x1019a2d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x7c
mov eax, dword [0x10205ac8]
xor eax, esp
mov dword [esp + 0x78], eax
push esi
push 1
push 0x323b2322
push 0x3a1f0727
push 0x361e0f23
mov byte [esp + 0x1f], 0
call fcn.10199560
test eax, eax
jne 0x1019a3c2
lea eax, [esp + 0x10]
xorps xmm0, xmm0
push eax
push 0xa
push 0
movaps xmmword [esp + 0x1c], xmm0
call fcn.1019eb84
cmp eax, 1
jne 0x1019a338
mov eax, dword [esp + 0x18]
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
cmp eax, 0xffffffff
jne 0x1019a3c2
lea eax, [esp + 0x20]
xorps xmm0, xmm0
push eax
push 0x11
push 0
movaps xmmword [esp + 0x2c], xmm0
call fcn.1019eb84
cmp eax, 1
jne 0x1019a364
mov eax, dword [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
cmp eax, 0xffffffff
jne 0x1019a3c2
movaps xmm0, xmmword [0x10059500]
lea eax, [esp + 0x38]
push 7
push eax
mov dword [esp + 0x40], 0x79784f42
movups xmmword [esp + 0x44], xmm0
mov dword [esp + 0x54], 0x6b693c1b
mov dword [esp + 0x58], 0x180f6162
call fcn.10199040
lea eax, [esp + 0x38]
push eax
push 0
push 0x100000
call fcn.1019f500
push 0x40
mov esi, eax
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.101b66d0
add esp, 0xc
test esi, esi
je 0x1019a3d4
push esi
call fcn.10199010
mov al, 1
pop esi
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.101b4a00
mov esp, ebp
pop ebp
ret
push 0
push 0
push 1
call fcn.10199ef0
test al, 1
jne 0x1019a3c2
push 1
call fcn.10199b90
test al, 1
mov ecx, 1
movzx eax, byte [esp + 0xf]
cmovne eax, ecx
mov ecx, dword [esp + 0x7c]
pop esi
xor ecx, esp
call fcn.101b4a00
mov esp, ebp
pop ebp
ret
Function at 0x101c07a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
test edx, edx
je 0x101c086c
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x101c086b
push edi
mov edi, dword [esp + 0x14]
xor ecx, ecx
test edi, edi
je 0x101c0866
push esi
cmp edi, 0x40
jb 0x101c084b
lea eax, [edi - 1]
lea esi, [edi - 1]
add eax, edx
add esi, ebx
cmp ebx, eax
ja 0x101c07e0
cmp esi, edx
jae 0x101c084b
movaps xmm1, xmmword [0x1005c8e0]
lea esi, [edx + 0x30]
mov eax, edi
mov edi, edx
and eax, 0xffffffc0
sub edi, ebx
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x10]
push ebp
nop dword [eax + eax]
movups xmm0, xmmword [esi - 0x30]
add ecx, 0x40
lea esi, [esi + 0x40]
lea eax, [eax + 0x40]
mov ebp, ecx
pxor xmm0, xmm1
movups xmmword [eax - 0x50], xmm0
movups xmm0, xmmword [edi + eax - 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x40], xmm0
movups xmm0, xmmword [esi - 0x50]
pxor xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [esi - 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
cmp ecx, dword [esp + 0x14]
jb 0x101c0800
mov edi, dword [esp + 0x1c]
cmp ebp, edi
pop ebp
jae 0x101c0865
mov esi, edi
lea eax, [ecx + ebx]
sub edx, ebx
sub esi, ecx
mov cl, byte [eax + edx]
lea eax, [eax + 1]
xor cl, 0x67
mov byte [eax - 1], cl
sub esi, 1
jne 0x101c0854
pop esi
mov byte [ebx + edi], 0
pop edi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x47de286c
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, str._zd
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x7a0025d4
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40d29e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407cfb
mov dword [ebp - 0x14], eax
cmp dword [0x813f98], esi
jne 0x40d391
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d31e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d471
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d471
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d471
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x813f98], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x813f9c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x813fa0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x813fa8], eax
test eax, eax
je 0x40d38e
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x813fa4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d3b6
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d3a9
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d3cb
push 4
pop eax
jmp 0x40d473
cmp dword [ebp - 0x14], esi
je 0x40d3cb
push dword [0x813f98]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d3b0
mov eax, dword [0x813fa4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d429
cmp dword [0x813fa8], edi
je 0x40d429
push eax
call ebx
push dword [0x813fa8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d429
test eax, eax
je 0x40d429
call ecx
test eax, eax
je 0x40d41e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d41e
test byte [ebp - 8], 1
jne 0x40d429
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d459
mov eax, dword [0x813f9c]
cmp eax, edi
je 0x40d456
push eax
call ebx
test eax, eax
je 0x40d456
call eax
mov esi, eax
test esi, esi
je 0x40d456
mov eax, dword [0x813fa0]
cmp eax, edi
je 0x40d456
push eax
call ebx
test eax, eax
je 0x40d456
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x813f98]
call ebx
test eax, eax
je 0x40d471
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d473
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040440e
mov esp, ebp
pop ebp
ret
Function at 0x8c3058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8c31a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8c307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8c306a
add dl, dl
jne 0x8c3089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8c30dc
xor eax, eax
add dl, dl
jne 0x8c3096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8c317d
add dl, dl
jne 0x8c30a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c30b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c30bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c30c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8c30d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8c3075
mov eax, 1
add dl, dl
jne 0x8c30ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c30f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8c30e1
sub eax, ebx
mov ebx, 1
jne 0x8c3128
mov ecx, 1
add dl, dl
jne 0x8c310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8c3119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8c3105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8c3075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8c313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8c314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8c3136
cmp eax, 0x7d00
jae 0x8c316d
cmp eax, 0x500
jb 0x8c3168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8c3075
cmp eax, 0x7f
ja 0x8c3170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8c3075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8c319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8c3075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40117d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1f40
call fcn.00406920
push ebx
push esi
mov edx, 0x1f3
push edi
xor ebx, ebx
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x7cf]
mov byte [ebp - 0x7d0], bl
mov byte [ebp - 0xfa0], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0xf9f]
mov byte [ebp - 0x1770], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0x14]
mov ecx, edx
lea edi, [ebp - 0x176f]
mov byte [ebp - 0x1f40], bl
mov byte [eax], bl
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x1f3f]
mov esi, 0x7d0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1770]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x401227
push str.gmf1_
push dword [ebp + 0x14]
call section..text
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 0x14]
call fcn.0040114c
jmp 0x401294
lea eax, [ebp - 0x1770]
push eax
lea eax, [ebp - 0x7d0]
push eax
call section..text
pop ecx
lea eax, [ebp - 0x1f40]
pop ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x401255
push str.gcd1_
jmp 0x40120c
lea eax, [ebp - 0x1f40]
push eax
lea eax, [ebp - 0xfa0]
push eax
call section..text
lea eax, [ebp - 0x7d0]
push eax
push dword [ebp + 0xc]
call section..text
push dword [ebp + 0xc]
call fcn.00401118
add esp, 0x14
cmp eax, 3
jge 0x4012a8
push 0x40a034
push dword [ebp + 0x14]
call section..text
mov esi, str.bzinst.exe
push esi
push dword [ebp + 0xc]
call section..text
push esi
jmp 0x4013a6
lea eax, [ebp - 0xfa0]
push eax
call fcn.00401118
cmp eax, 3
pop ecx
jge 0x4012dc
push 0x40a024
push dword [ebp + 0x14]
call section..text
push str.bzinst.exe
push dword [ebp + 0x10]
call section..text
add esp, 0x10
jmp 0x4013b1
lea eax, [ebp - 0x7d0]
push eax
call fcn.00401118
mov edi, eax
lea eax, [ebp - 0xfa0]
push eax
call fcn.00401118
mov esi, eax
pop ecx
cmp esi, edi
pop ecx
jge 0x40134b
lea eax, [esi - 1]
push eax
lea eax, [ebp - 0x7cf]
push eax
lea eax, [ebp - 0xf9f]
push eax
call fcn.0040108c
add esp, 0xc
test eax, eax
jne 0x40134b
mov al, byte [ebp + esi - 0x7d0]
cmp al, 0x5c
je 0x40132b
cmp al, 0x2f
jne 0x40132c
inc esi
lea eax, [ebp + esi - 0x7d0]
push eax
push dword [ebp + 0x10]
call section..text
push dword [ebp + 0x10]
call fcn.00401118
add esp, 0xc
test eax, eax
jg 0x4013b1
lea esi, [edi - 1]
cmp esi, ebx
jl 0x401383
mov al, byte [ebp + esi - 0x7d0]
cmp al, 0x2f
je 0x401361
cmp al, 0x5c
jne 0x401380
lea eax, [ebp + esi - 0x7cf]
push eax
push dword [ebp + 0x10]
call section..text
push dword [ebp + 0x10]
call fcn.00401118
add esp, 0xc
test eax, eax
jg 0x4013b1
dec esi
jns 0x401352
push 0x40a020
push dword [ebp + 0x14]
call section..text
lea eax, [ebp - 0x7d0]
push eax
push dword [ebp + 0x14]
call fcn.00401130
lea eax, [ebp - 0x7d0]
push eax
push dword [ebp + 0x10]
call section..text
add esp, 0x18
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40270d
Capabilities:
Check os version
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
xor ebx, ebx
cmp edi, ebx
je 0x40274c
cmp byte [edi], bl
je 0x40274c
mov esi, 0x40a048
push ebx
push esi
call fcn.00401597
push ebx
push str.Usage:
call fcn.00401597
push ebx
push edi
call fcn.00401597
push ebx
push str.___h_____other_options_described_below___n
call fcn.00401597
add esp, 0x20
jmp 0x402766
mov esi, 0x40a048
push ebx
push esi
call fcn.00401597
push ebx
push str.Options:___h_____other_options_described_below___n
call fcn.00401597
add esp, 0x10
push ebx
push esi
call fcn.00401597
push ebx
push str.__h_generates_this_message_n
call fcn.00401597
push ebx
push str.__version_prints_installation_version_info_and_exits_n
call fcn.00401597
push ebx
push str.__nogui_suppress_main_GUI__still_allows_error_popup_dialogs_n
call fcn.00401597
push ebx
push str.__unpackonly_does_not_run_installer__just_unpacks_this_archive_n
call fcn.00401597
push ebx
push str.__installdir__dir__uses__dir__as_final_location_of_install_n
call fcn.00401597
push ebx
push str.__createaccount__emailaddr___password__creates_this_new_account_n
call fcn.00401597
push ebx
push str.__signinaccount__emailaddr___password__signs_into_this_existing_account_n
call fcn.00401597
add esp, 0x40
push ebx
push esi
call fcn.00401597
push ebx
push str._Example_1:
call fcn.00401597
push ebx
push edi
call fcn.00401597
push ebx
push esi
call fcn.00401597
push ebx
push str._Example_2:
call fcn.00401597
push ebx
push edi
call fcn.00401597
push ebx
push str.__nogui_n
call fcn.00401597
push ebx
push str._Example_3:
call fcn.00401597
add esp, 0x40
push ebx
push edi
call fcn.00401597
push ebx
push str.__nogui__installdir__C:Program_FilesBackblaze__n
call fcn.00401597
push ebx
push str._Example_4:
call fcn.00401597
push ebx
push edi
call fcn.00401597
push ebx
push str.__nogui__createaccount_user_corp.com_pass6_n
call fcn.00401597
push ebx
push str._Example_5:
call fcn.00401597
push ebx
push edi
call fcn.00401597
push ebx
push str.__nogui__createaccount_u_c.com_p7_gpID_gpToken_n
call fcn.00401597
add esp, 0x40
push 1
push esi
call fcn.00401597
pop ecx
pop ecx
push 1
call dword [sym.imp.MSVCRT.dll_exit]
pop edi
pop esi
pop ebx
Function at 0x40286c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push ebx
push esi
mov esi, 0x9c
lea eax, [ebp - 0x9c]
push esi
push 0
push eax
xor bl, bl
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
jne 0x4028c0
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0x94
push eax
call esi
test eax, eax
je 0x4028d0
mov eax, dword [ebp - 0x8c]
dec eax
je 0x402973
dec eax
je 0x4028d4
xor al, al
jmp 0x402947
mov ecx, dword [ebp - 0x98]
cmp ecx, 4
ja 0x4028e6
push str.WinNT
jmp 0x402939
mov eax, dword [ebp - 0x94]
cmp ecx, 5
jne 0x40290f
test eax, eax
jne 0x4028fc
push str.Win2000
jmp 0x402939
cmp eax, 1
jne 0x402908
push str.WinXP
jmp 0x402919
cmp eax, 2
jne 0x40294b
jmp 0x402934
cmp ecx, 6
jb 0x40294b
push str.WinVistaOrGreater
push dword [ebp + 8]
call section..text
pop ecx
mov bl, 1
pop ecx
push str.C:WINDOWSSystem32Dfssvc.exe
call fcn.00403533
test al, al
pop ecx
je 0x402945
push str.Win2003
push dword [ebp + 8]
call section..text
pop ecx
xor bl, bl
pop ecx
mov al, bl
pop esi
pop ebx
leave
ret
push eax
push ecx
lea eax, [ebp - 0x168]
push str.WinNt_d._d
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x168]
push eax
push dword [ebp + 8]
call section..text
add esp, 0x18
jmp 0x402945
cmp dword [ebp - 0x98], 4
jne 0x402945
cmp dword [ebp - 0x94], 0
jne 0x40298c
push str.Win95
jmp 0x402939
cmp dword [ebp - 0x94], 0xa
jne 0x40299c
push str.Win98
jmp 0x402939
cmp dword [ebp - 0x94], 0x5a
jne 0x402945
push str.WinME
jmp 0x402939
Function at 0x402ceb
Capabilities:
Create pipe
Create process on windows
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push dword [ebp + 8]
xor esi, esi
mov dword [eax], esi
lea eax, [ebp - 0x83c]
push eax
call section..text
push 0xc
lea eax, [ebp - 0x14]
pop edi
push edi
push esi
push eax
call fcn.00401054
add esp, 0x14
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x14]
push 1
pop edi
push esi
push eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x402d52
push edi
push str.ERROR:_RunCommand__CreatePipe_failed__errA
call fcn.00401597
pop ecx
pop ecx
push edi
call dword [sym.imp.MSVCRT.dll_exit]
push 0x44
lea eax, [ebp - 0x68]
pop ebx
push ebx
push esi
push eax
call fcn.00401054
add esp, 0xc
mov dword [ebp - 0x68], ebx
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov cl, byte [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov word [ebp - 0x38], 5
neg cl
sbb ecx, ecx
mov dword [ebp - 0x2c], eax
and ecx, eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push esi
push 0x8000000
lea eax, [ebp - 0x14]
push edi
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x83c]
push eax
push esi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x3c], 0x181
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x402dc5
push edi
push str.ERROR:_RunCommand__CreatePipe_failed__errB
jmp 0x402e70
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov esi, 0x7a121
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x402df9
push 1
push str.ERROR:_RunCommand__malloc_DDD_bytes_failed_n
call fcn.00401597
pop ecx
pop ecx
push 1
call dword [sym.imp.MSVCRT.dll_exit]
mov dword [ebp + 0x10], esi
xor esi, esi
lea eax, [ebp - 4]
push 0
push eax
lea eax, [esi + ebx]
push 0x7a120
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402e55
mov eax, dword [ebp - 4]
test eax, eax
je 0x402e7b
add eax, esi
lea ecx, [eax + 0x7a121]
cmp ecx, dword [ebp + 0x10]
jle 0x402e51
add eax, 0xf4241
push eax
push ebx
call dword [sym.imp.MSVCRT.dll_realloc]
mov ebx, eax
pop ecx
test ebx, ebx
pop ecx
je 0x402e69
mov eax, dword [ebp - 4]
add eax, esi
lea ecx, [eax + 0xf4241]
mov dword [ebp + 0x10], ecx
mov esi, eax
jmp 0x402dfe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x402e7b
push 1
push str.ERROR:_RunCommand__ReadFile_errE_n
jmp 0x402e70
push 1
push str.ERROR:_RunCommand__realloc_FFF_bytes_failed_n
call fcn.00401597
pop ecx
xor eax, eax
pop ecx
jmp 0x402e95
and byte [esi + ebx], 0
mov eax, dword [ebp + 0xc]
push dword [ebp - 8]
mov dword [eax], esi
call edi
push dword [ebp - 0x20]
call edi
push dword [ebp - 0x24]
call edi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret