joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007dfa0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000b540
push eax
call fcn.100948f1
add esp, 4
test eax, eax
jne 0x1007dfc2
mov dword [ebp - 4], 1
jmp 0x1007dfc9
mov dword [ebp - 4], 0
movzx eax, byte [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1007ec60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 8]
call fcn.1000b540
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x1007ec87
mov dword [ebp - 4], 1
jmp 0x1007ec8e
mov dword [ebp - 4], 0
movzx eax, byte [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1007f130
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
call fcn.1000b540
push eax
mov ecx, dword [ebp + 8]
call fcn.1000b540
push eax
call fcn.1009491b
add esp, 8
pop ebp
ret

Function at 0x1007fad0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eb770
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x101170e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x124], ecx
mov eax, dword [ebp - 0x124]
movzx ecx, byte [eax + 0x3c]
test ecx, ecx
je 0x1007fb1e
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1007fb1e
jmp 0x1007fbbb
push 0x10c
lea ecx, [ebp - 0x11c]
call fcn.1002f1d0
lea ecx, [ebp - 0x11e]
call fcn.1000b300
push eax
lea ecx, [ebp - 0x11c]
call fcn.10020160
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x124]
add ecx, 8
call fcn.10024da0
mov dword [ebp - 0x128], eax
lea edx, [ebp - 0x11c]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x128]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x128]
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 0x11d], 0
lea ecx, [ebp - 0x11d]
push ecx
lea ecx, [ebp - 0x11c]
call fcn.10036030
lea ecx, [ebp - 0x11c]
call fcn.1002edf0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11c]
call fcn.10023350
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008511a
mov esp, ebp
pop ebp
ret 4
Function at 0x100819f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x101170e4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
push 0x18
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_GetObjectW]
lea edx, [ebp - 0x24]
push edx
call fcn.100817d0
add esp, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
push eax
call fcn.1009199d
add esp, 4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.GDI32.dll_GetBitmapBits]
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x28], ecx
jmp 0x10081a54
mov edx, dword [ebp - 0x28]
sub edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0
jl 0x10081aa7
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x28]
imul edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x18]
and ecx, 3
je 0x10081aa5
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 8]
push edx
mov eax, 4
sub eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x10081a4b
mov eax, dword [ebp - 0x2c]
push eax
call fcn.10091982
add esp, 4
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008511a
mov esp, ebp
pop ebp
ret

Function at 0x10081ad0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x101170e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x5c]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.10081770
add esp, 0x10
lea ecx, [ebp - 0x30]
push ecx
call fcn.100817d0
add esp, 4
mov esi, eax
lea edx, [ebp - 0x48]
push edx
call fcn.100817d0
add esp, 4
add esi, eax
mov dword [ebp - 0x64], esi
movzx eax, word [ebp - 0x1e]
cmp eax, 8
jl 0x10081b2a
mov dword [ebp - 0x60], 0
jmp 0x10081b3f
movzx ecx, word [ebp - 0x1e]
movzx edx, word [ebp - 0x20]
imul ecx, edx
mov eax, 1
shl eax, cl
mov dword [ebp - 0x60], eax
mov cl, byte [ebp - 0x2c]
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x28]
mov byte [ebp - 0x13], dl
movzx eax, byte [ebp - 0x60]
mov byte [ebp - 0x12], al
mov byte [ebp - 0x11], 0
mov cx, word [ebp - 0x20]
mov word [ebp - 0x10], cx
mov dx, word [ebp - 0x1e]
mov word [ebp - 0xe], dx
mov eax, dword [ebp - 0x64]
add eax, 0x28
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
push 0
lea edx, [ebp - 0x18]
push edx
push 0x10
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x18]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008511a
mov esp, ebp
pop ebp
ret
Function at 0x10081c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x101170e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, dword [ebp + 0xc]
push eax
call fcn.100817d0
add esp, 4
mov esi, eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.100817d0
add esp, 4
add esi, eax
mov dword [ebp - 0x34], esi
xor edx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x30], 0x28
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
shl eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
mov dx, word [ecx + 0x10]
mov word [ebp - 0x24], dx
mov eax, dword [ebp + 0xc]
mov cx, word [eax + 0x12]
mov word [ebp - 0x22], cx
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x1c], edx
push 0
lea eax, [ebp - 8]
push eax
push 0x28
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008511a
mov esp, ebp
pop ebp
ret

Function at 0x10087460
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1008743c
pop esi
leave
ret 8
Function at 0x10092bcc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.100e4590
mov eax, dword [0x101170e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1009481a
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x10092c0e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10092d6a
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.100854e0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x10120928]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.1009cf02
mov ecx, dword [esi*4 + 0x10120928]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x10092d63
cmp eax, dword [edi + ecx + 0x24]
jne 0x10092d63
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10092d63
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1009cf02
add esp, 0x14
test edx, edx
jl 0x10092d63
jg 0x10092cd9
test eax, eax
jb 0x10092d63
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10092d63
jl 0x10092cf3
cmp dword [ebp - 0x1008], eax
ja 0x10092d63
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x10092d11
test ebx, ebx
je 0x10092d4a
cmp ecx, edi
jae 0x10092d4a
mov al, byte [ecx]
cmp al, 0xd
jne 0x10092d2b
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10092d37
cmp byte [ecx + 1], 0xa
jne 0x10092d37
inc ecx
jmp 0x10092d37
movzx eax, al
movsx eax, byte [eax + 0x10117448]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10092d11
cmp edx, ebx
jne 0x10092d11
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10092d68
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1008511a
leave
ret

Function at 0x1009b495
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100fb224
push 0x100fb21c
push str.FlsAlloc
push 0x1e
call fcn.1009b2c2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1009b4c9
push dword [ebp + 8]
mov ecx, esi
call dword [0x100f14a4]
call esi
jmp 0x1009b4cf
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x1009b513
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100fb234
push 0x100fb22c
push str.FlsGetValue
push 0x20
call fcn.1009b2c2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1009b54a
push dword [ebp + 8]
mov ecx, esi
call dword [0x100f14a4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1009c0e9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10120928]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1009c129
cmp byte [ebx], 0xa
jne 0x1009c129
or byte [eax + edi + 0x28], 4
jmp 0x1009c12e
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x1009c22c
mov al, byte [edx]
cmp al, 0x1a
je 0x1009c20e
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x1009c15d
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x1009c182
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x1009c18c
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x1009c13f
jmp 0x1009c22c
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1009c209
cmp dword [ebp - 0xc], 0
je 0x1009c209
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x10120928]
test byte [eax + edi + 0x28], 0x48
je 0x1009c1e3
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1009c1ce
mov byte [esi], dl
jmp 0x1009c1df
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10120928]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1009c22c
cmp byte [ebp - 1], 0xa
jne 0x1009c1f2
cmp esi, ebx
jne 0x1009c1f2
mov byte [esi], 0xa
jmp 0x1009c22b
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1009cf20
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1009c22c
mov byte [esi], 0xd
jmp 0x1009c22b
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x10120928]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1009c228
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1009c22c
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1009c235
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x10120928]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1009c278
cmp word [esi], dx
jne 0x1009c278
or byte [edi + eax + 0x28], 4
jmp 0x1009c27d
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x1009c3d0
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x1009c3b0
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x1009c2bf
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1009c2f5
cmp eax, edx
jae 0x1009c301
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x1009c297
jmp 0x1009c3d0
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1009c3ac
cmp dword [ebp - 0x14], 0
je 0x1009c3ac
mov eax, dword [ebx*4 + 0x10120928]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x1009c384
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x1009c34d
mov word [esi], cx
jmp 0x1009c380
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x10120928]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x10120928]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x10120928]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x1009c3d0
pop ebx
cmp word [ebp - 4], bx
jne 0x1009c395
cmp esi, dword [ebp + 0xc]
jne 0x1009c395
mov word [esi], bx
jmp 0x1009c3cd
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1009cf20
add esp, 0x10
cmp word [ebp - 4], bx
je 0x1009c3d0
push 0xd
jmp 0x1009c3c9
mov ecx, dword [ebx*4 + 0x10120928]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1009c3c7
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1009c3d0
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1009cbf1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1009ca62
Function at 0x100a0904
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100a09a1
push ebx
push esi
call fcn.100a08cd
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100a0816
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100a094e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100a09a0
push edi
push eax
call fcn.10099b61
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100a096e
call fcn.10099b27
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100a099f
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100a0816
add esp, 0x20
test eax, eax
jne 0x100a098d
push edi
call fcn.10099b27
jmp 0x100a0995
push ebx
call fcn.10099b27
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100a09a4
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100a09b5
pop esi
ret
push ebx
push edi
push esi
call fcn.100a08cd
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.10099b61
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100a09dd
push ebx
push esi
push edi
call fcn.10088a20
add esp, 0xc
push 0
call fcn.10099b27
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100a0da1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100a09f2
Function at 0x100a7f31
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100a7ead
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100a80a9
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100a80a9
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100a8058
jg 0x100a7f8a
test eax, eax
je 0x100a804e
push 1
push 0x1000
call fcn.1009afc4
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100a7fb0
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x100a8045
push 0x8000
push ebx
call fcn.100a7dde
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100a7fdc
jg 0x100a7fd7
cmp ecx, 0x1000
jb 0x100a7fdc
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1009d86b
add esp, 0x10
cmp eax, 0xffffffff
je 0x100a8021
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100a7fd7
jl 0x100a8008
test ecx, ecx
jne 0x100a7fc9
push dword [ebp - 0xc]
push ebx
call fcn.100a7dde
push esi
call fcn.10099b27
add esp, 0xc
xor edi, edi
jmp 0x100a80ba
cmp byte [edi + 0x24], 0
je 0x100a8038
cmp dword [edi + 0x20], 5
jne 0x100a8038
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100a8043
mov edi, dword [edi + 0x18]
jmp 0x100a8045
xor edi, edi
push esi
call fcn.10099b27
pop ecx
jmp 0x100a80ba
test ecx, ecx
jg 0x100a801a
jl 0x100a8058
test eax, eax
jae 0x100a801a
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1009cf20
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100a807b
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x100a801a
jmp 0x100a80b2
push ebx
call fcn.1009f73b
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100a801a
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x100a80ba
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x100a80b7
mov edi, dword [edi + 0x18]
jmp 0x100a80ba
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1009cf20
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100a9a30
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x230
mov eax, dword [0x101170e4]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
mov esi, dword [esp + 0x238]
cmp dword [esi + 0x10], 0
jne 0x100a9a6a
xor al, al
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.1008511a
add esp, 0x230
ret
push ebx
push ebp
push 0
push 2
xor bl, bl
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
test ebp, ebp
je 0x100a9b1a
push edi
push 0x228
lea eax, [esp + 0x18]
push 0
push eax
call fcn.10088fa0
add esp, 0xc
mov dword [esp + 0x10], 0x22c
lea eax, [esp + 0x10]
push eax
push ebp
call sub.KERNEL32.dll_Process32FirstW
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100a9b16
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x100a9abd
mov eax, dword [esi]
push eax
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100a9b07
push dword [esp + 0x18]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x100a9b01
push 2
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
movzx ebx, bl
mov eax, 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmovne ebx, eax
call edi
jmp 0x100a9b07
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x100a9ab3
push ebp
call edi
pop edi
mov ecx, dword [esp + 0x238]
mov al, bl
pop ebp
pop ebx
pop esi
xor ecx, esp
call fcn.1008511a
add esp, 0x230
ret

Function at 0x100a9b40
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x100a9b66
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x100a9b66
push 2
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne al
ret
xor al, al
ret
Function at 0x100a9b70
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x230
mov eax, dword [0x101170e4]
xor eax, esp
mov dword [esp + 0x22c], eax
push edi
mov edi, dword [esp + 0x238]
test edi, edi
je 0x100a9c39
push ebx
push ebp
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, eax
test ebx, ebx
je 0x100a9c23
push esi
push 0x228
lea eax, [esp + 0x18]
push 0
push eax
call fcn.10088fa0
add esp, 0xc
mov dword [esp + 0x10], 0x22c
lea eax, [esp + 0x10]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100a9c1f
nop dword [eax]
cmp dword [esp + 0x28], edi
jne 0x100a9c10
push dword [esp + 0x18]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100a9c0a
push 2
push esi
call ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x100a9c10
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x10]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x100a9be0
push ebx
call esi
pop esi
push edi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x100a9c37
push 2
push eax
call ebp
pop ebp
pop ebx
mov ecx, dword [esp + 0x230]
pop edi
xor ecx, esp
call fcn.1008511a
add esp, 0x230
ret