joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006c39
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x60
push 0x1002180
call fcn.0100808c
mov edi, 0x94
mov eax, edi
call fcn.010074e0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x100f7c0], ecx
mov eax, dword [esi + 4]
mov dword [0x100f7cc], eax
mov edx, dword [esi + 8]
mov dword [0x100f7d0], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x100f7c4], esi
cmp ecx, 2
je 0x1006c99
or esi, 0x8000
mov dword [0x100f7c4], esi
shl eax, 8
add eax, edx
mov dword [0x100f7c8], eax
cmp word [0x1000000], 0x5a4d
jne 0x1006cd5
mov eax, dword [0x100003c]
lea eax, [eax + 0x1000000]
cmp dword [eax], 0x4550
jne 0x1006cd5
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x1006cee
cmp ecx, 0x20b
je 0x1006cdb
and dword [ebp - 0x1c], 0
jmp 0x1006d02
cmp dword [eax + 0x84], 0xe
jbe 0x1006cd5
xor ecx, ecx
cmp dword [eax + 0xf8], ecx
jmp 0x1006cfc
cmp dword [eax + 0x74], 0xe
jbe 0x1006cd5
xor ecx, ecx
cmp dword [eax + 0xe8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
push 0
call fcn.0100802f
pop ecx
test eax, eax
jne 0x1006d2f
cmp dword [0x100f7b0], 1
jne 0x1006d1c
call fcn.0100780b
push 0x1c
call fcn.0100761e
push 0xff
call fcn.01006fba
pop ecx
pop ecx
and dword [ebp - 4], 0
call fcn.01007e5f
test eax, eax
jge 0x1006d44
push 0x1b
call fcn.01006c0a
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1010e34], eax
call fcn.01007d32
mov dword [0x100f7a8], eax
call fcn.01007c89
test eax, eax
jge 0x1006d6a
push 8
call fcn.01006c0a
pop ecx
call fcn.01007a2f
test eax, eax
jge 0x1006d7b
push 9
call fcn.01006c0a
pop ecx
call fcn.01007014
mov dword [ebp - 0x28], eax
test eax, eax
je 0x1006d8e
push eax
call fcn.01006c0a
pop ecx
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.010079c1
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x1006db0
movzx eax, word [ebp - 0x40]
jmp 0x1006db3
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push 0
push 0x1000000
call fcn.01006508
mov esi, eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x1c], 0
jne 0x1006dd4
push esi
call fcn.010070f4
call fcn.0100712c
jmp 0x1006e06
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x7c]
call fcn.010080c7
ret
Function at 0x100761e
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x100f05c]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x100f070]
je 0x1007648
inc eax
cmp eax, 0x12
jb 0x1007639
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x100f070]
mov dword [ebp - 0x110], esi
jne 0x10077f3
mov eax, dword [0x100f7b0]
cmp eax, 1
je 0x10077c1
test eax, eax
jne 0x100767e
cmp dword [0x100f064], 1
je 0x10077c1
cmp ecx, 0xfc
je 0x10077f3
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10076b9
push 5
pop ecx
mov esi, 0x10024f4
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebx, [ebp - 0x10c]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10076c4
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x10076fc
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10076dc
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x10024f0
push ebx
call fcn.0100a4e0
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1007701
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x110]
mov eax, dword [eax + 0x100f074]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100771b
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.010074e0
mov edx, esp
push 6
pop ecx
mov esi, 0x10024d4
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1007747
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1007753
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100776c
mov eax, dword [ebp - 0x110]
mov esi, 0x10024d0
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 0x100f074]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100778a
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1007796
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x10024a8
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.0100a3dd
add esp, 0xc
jmp 0x10077f3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x10077f3
mov esi, dword [esi + 0x100f074]
mov ecx, esi
lea edx, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x10077d8
push 0
sub ecx, edx
lea edx, [ebp - 0x114]
push edx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x120]
mov ecx, dword [ebp - 4]
call fcn.01006af2
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1007d32
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100f940]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push edi
xor ebx, ebx
xor edi, edi
cmp eax, ebx
jne 0x1007d7e
call esi
mov edi, eax
cmp edi, ebx
je 0x1007d64
mov dword [0x100f940], 1
jmp 0x1007d83
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1007d79
push 2
pop eax
mov dword [0x100f940], eax
jmp 0x1007d7e
mov eax, dword [0x100f940]
cmp eax, 1
jne 0x1007dfb
cmp edi, ebx
jne 0x1007d8f
call esi
mov edi, eax
cmp edi, ebx
je 0x1007e04
cmp word [edi], bx
mov eax, edi
je 0x1007da4
inc eax
inc eax
cmp word [eax], bx
jne 0x1007d96
inc eax
inc eax
cmp word [eax], bx
jne 0x1007d96
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, edi
push ebx
sar eax, 1
inc eax
push eax
push edi
push ebx
push ebx
mov dword [ebp - 0xc], eax
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x1007df2
push eax
call fcn.01006f3e
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x1007df2
push ebx
push ebx
push dword [ebp - 8]
push eax
push dword [ebp - 0xc]
push edi
push ebx
push ebx
call esi
test eax, eax
jne 0x1007def
push dword [ebp - 4]
call fcn.01006e79
pop ecx
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1007e53
cmp eax, 2
je 0x1007e08
cmp eax, ebx
je 0x1007e08
xor eax, eax
jmp 0x1007e55
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x1007e04
cmp byte [esi], bl
je 0x1007e25
inc eax
cmp byte [eax], bl
jne 0x1007e1b
inc eax
cmp byte [eax], bl
jne 0x1007e1b
sub eax, esi
inc eax
mov edi, eax
push edi
call fcn.01006f3e
cmp eax, ebx
pop ecx
je 0x1007e4c
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 4]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1009be1
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov ecx, dword [ebp + 8]
cmp ecx, dword [0x1010d08]
mov eax, dword [0x100f05c]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], edi
jae 0x1009dc7
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x1010d20]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x424], ebx
je 0x1009dc7
and dword [ebp - 0x414], 0
and dword [ebp - 0x420], 0
cmp dword [ebp + 0x10], 0
jne 0x1009c52
xor eax, eax
jmp 0x1009ddb
test al, 0x20
je 0x1009c65
push 2
push 0
push 0
push ecx
call fcn.0100b832
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x1009d25
and dword [ebp - 0x40c], 0
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x410], edi
jbe 0x1009da1
mov ecx, dword [ebp - 0x410]
xor edi, edi
sub ecx, dword [ebp - 0x41c]
lea eax, [ebp - 0x408]
cmp ecx, dword [ebp + 0x10]
jae 0x1009cd4
mov edx, dword [ebp - 0x410]
inc dword [ebp - 0x410]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x1009cc2
inc dword [ebp - 0x420]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x424]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x1009c9e
mov edi, eax
lea eax, [ebp - 0x408]
sub edi, eax
push 0
lea eax, [ebp - 0x418]
push eax
push edi
lea eax, [ebp - 0x408]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1009d53
mov eax, dword [ebp - 0x418]
add dword [ebp - 0x414], eax
cmp eax, edi
jl 0x1009d5f
mov eax, dword [ebp - 0x410]
sub eax, dword [ebp - 0x41c]
cmp eax, dword [ebp + 0x10]
jb 0x1009c8a
jmp 0x1009d5f
push 0
lea ecx, [ebp - 0x418]
push ecx
push dword [ebp + 0x10]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1009d53
mov eax, dword [ebp - 0x418]
and dword [ebp - 0x40c], 0
mov dword [ebp - 0x414], eax
jmp 0x1009d5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x414]
test eax, eax
jne 0x1009dbf
cmp dword [ebp - 0x40c], eax
je 0x1009d9b
push 5
pop eax
cmp dword [ebp - 0x40c], eax
jne 0x1009d8d
mov dword [0x100f7b4], 9
mov dword [0x100f7b8], eax
jmp 0x1009dd8
push dword [ebp - 0x40c]
call fcn.0100b2fa
pop ecx
jmp 0x1009dd8
mov edi, dword [ebp - 0x41c]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x1009db3
cmp byte [edi], 0x1a
je 0x1009c4b
mov dword [0x100f7b4], 0x1c
jmp 0x1009dd1
sub eax, dword [ebp - 0x420]
jmp 0x1009ddb
mov dword [0x100f7b4], 9
and dword [0x100f7b8], 0
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01006af2
leave
ret
Function at 0x100a3dd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x100f978], ebx
push esi
push edi
jne 0x100a45f
push 0x1002920
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x100a49a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1002914
push edi
call esi
test eax, eax
mov dword [0x100f978], eax
je 0x100a49a
push 0x1002904
push edi
call esi
push 0x10028f0
push edi
mov dword [0x100f97c], eax
call esi
cmp dword [0x100f7c0], 2
mov dword [0x100f980], eax
jne 0x100a45f
push 0x10028d4
push edi
call esi
test eax, eax
mov dword [0x100f988], eax
je 0x100a45f
push 0x10028bc
push edi
call esi
mov dword [0x100f984], eax
mov eax, dword [0x100f984]
test eax, eax
je 0x100a4a4
call eax
test eax, eax
je 0x100a48b
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x100f988]
test eax, eax
je 0x100a48b
test byte [ebp - 8], 1
jne 0x100a4a4
cmp dword [0x100f7cc], 4
jb 0x100a49e
or byte [ebp + 0x12], 0x20
jmp 0x100a4c3
xor eax, eax
jmp 0x100a4d3
or byte [ebp + 0x12], 4
jmp 0x100a4c3
mov eax, dword [0x100f97c]
test eax, eax
je 0x100a4c3
call eax
mov ebx, eax
test ebx, ebx
je 0x100a4c3
mov eax, dword [0x100f980]
test eax, eax
je 0x100a4c3
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x100f978]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100ab62
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x100ab93
mov eax, dword fs:[4]
mov dword [ebp + 8], eax
mov eax, dword fs:[8]
mov dword [ebp - 4], eax
cmp ebx, dword [ebp - 4]
jb 0x100ab9a
cmp ebx, dword [ebp + 8]
jae 0x100ab9a
xor eax, eax
jmp 0x100ad8a
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x100abab
xor eax, eax
inc eax
jmp 0x100ad89
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x100abc1
cmp ecx, edx
jae 0x100ad06
cmp dword [eax + 4], 0
je 0x100abca
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x100abb2
cmp dword [ebp + 8], 0
je 0x100abec
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x100ad06
cmp eax, esi
jae 0x100ad06
mov eax, dword [0x100f990]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x100ac11
cmp dword [esi*4 + 0x100f998], edi
je 0x100ad0a
inc esi
cmp esi, eax
jl 0x100abff
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100ad86
cmp dword [ebp - 8], 0x1000000
jne 0x100ad86
test byte [ebp - 0xc], 0xcc
je 0x100ac8f
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x100ad86
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100ad86
cmp word [eax + 0x18], 0x10b
jne 0x100ad86
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x100ad86
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x100ac8f
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x100ac8f
test byte [ecx + 0x27], 0x80
jne 0x100ad06
push 1
push 0x100f9d8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x100aba3
mov ecx, dword [0x100f990]
test ecx, ecx
mov edx, ecx
jle 0x100acc3
lea eax, [ecx*4 + 0x100f994]
cmp dword [eax], edi
je 0x100acc3
dec edx
sub eax, 4
test edx, edx
jg 0x100acb7
test edx, edx
jne 0x100acf4
push 0xf
pop ebx
cmp ecx, ebx
jg 0x100acd0
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x100ace8
lea eax, [edx*4 + 0x100f998]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x100acd6
cmp ecx, 0x10
jge 0x100acf4
inc ecx
mov dword [0x100f990], ecx
push 0
push 0x100f9d8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x100aba3
xor eax, eax
jmp 0x100ad89
test esi, esi
jle 0x100aba3
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x100f9d8
call ebx
test eax, eax
jne 0x100aba3
cmp dword [esi*4 + 0x100f998], edi
je 0x100ad60
mov eax, dword [0x100f990]
lea esi, [eax - 1]
test esi, esi
jl 0x100ad4e
cmp dword [esi*4 + 0x100f998], edi
je 0x100ad4a
dec esi
jns 0x100ad3e
test esi, esi
jge 0x100ad5e
cmp eax, 0x10
jge 0x100ad59
inc eax
mov dword [0x100f990], eax
lea esi, [eax - 1]
jmp 0x100ad60
je 0x100ad78
xor ecx, ecx
test esi, esi
jl 0x100ad78
lea eax, [ecx*4 + 0x100f998]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x100ad66
push 0
push 0x100f9d8
call ebx
jmp 0x100aba3
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100be3f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
push edi
mov dword [ebp - 8], ebx
je 0x100bea9
push 0x3d
push esi
call fcn.0100ce2d
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], edi
je 0x100bea9
cmp esi, edi
je 0x100bea9
xor eax, eax
cmp byte [edi + 1], al
sete al
mov dword [ebp - 4], eax
mov eax, dword [0x100f7e0]
cmp eax, dword [0x100f7e4]
jne 0x100be8f
call fcn.0100bdde
mov dword [0x100f7e0], eax
cmp eax, ebx
jne 0x100bee8
cmp dword [ebp + 0xc], ebx
je 0x100beb1
cmp dword [0x100f7e8], ebx
je 0x100beb1
call fcn.0100a02e
test eax, eax
je 0x100bee8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
jne 0x100bfef
push 4
call fcn.01006f3e
cmp eax, ebx
pop ecx
mov dword [0x100f7e0], eax
je 0x100bea9
mov dword [eax], ebx
cmp dword [0x100f7e8], ebx
jne 0x100bee8
push 4
call fcn.01006f3e
cmp eax, ebx
pop ecx
mov dword [0x100f7e8], eax
je 0x100bea9
mov dword [eax], ebx
mov ebx, dword [0x100f7e0]
sub edi, esi
push esi
call fcn.0100bd87
mov edi, eax
test edi, edi
pop ecx
jl 0x100bf41
cmp dword [ebx], 0
je 0x100bf41
lea esi, [ebx + edi*4]
push dword [esi]
call fcn.01006e79
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x100bf26
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov esi, eax
jmp 0x100bf77
mov ecx, dword [esi + 4]
mov dword [esi], ecx
inc edi
add esi, 4
cmp dword [esi], eax
jne 0x100bf1d
mov eax, edi
shl eax, 2
push eax
push ebx
call fcn.0100cc90
test eax, eax
mov esi, dword [ebp + 8]
pop ecx
pop ecx
je 0x100bf77
jmp 0x100bf72
cmp dword [ebp - 4], 0
jne 0x100bfe8
test edi, edi
jge 0x100bf51
neg edi
lea eax, [edi*4 + 8]
push eax
push ebx
call fcn.0100cc90
test eax, eax
pop ecx
pop ecx
je 0x100bea9
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov dword [0x100f7e0], eax
cmp dword [ebp + 0xc], 0
je 0x100bfd3
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100bf82
sub eax, edx
add eax, 2
push eax
call fcn.01006f3e
mov edi, eax
test edi, edi
pop ecx
je 0x100bfd3
mov ecx, esi
sub eax, esi
mov dl, byte [ecx]
mov byte [eax + ecx], dl
inc ecx
test dl, dl
jne 0x100bf9f
mov ecx, dword [ebp - 0xc]
add eax, ecx
mov ecx, dword [ebp - 4]
mov byte [eax], dl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x100bfcc
or dword [ebp - 8], 0xffffffff
push edi
call fcn.01006e79
pop ecx
cmp dword [ebp - 4], 0
je 0x100bfe0
push esi
call fcn.01006e79
pop ecx
mov eax, dword [ebp - 8]
jmp 0x100beac
push esi
call fcn.01006e79
pop ecx
xor eax, eax
jmp 0x100beac
Function at 0x100bffb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x1010d08]
push edi
jae 0x100c1d4
mov eax, esi
sar eax, 5
lea edi, [eax*4 + 0x1010d20]
mov eax, dword [edi]
and esi, 0x1f
shl esi, 3
add eax, esi
mov dl, byte [eax + 4]
test dl, 1
je 0x100c1d4
and dword [ebp - 0xc], 0
cmp dword [ebp + 0x10], 0
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
je 0x100c0a8
test dl, 2
jne 0x100c0a8
test dl, 0x48
je 0x100c072
cmp byte [eax + 5], 0xa
je 0x100c072
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea ecx, [ebx + 1]
mov dword [ebp - 0xc], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push ecx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100c0bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
cmp eax, ecx
jne 0x100c0a3
mov dword [0x100f7b8], ecx
jmp 0x100c1db
cmp eax, 0x6d
jne 0x100c0af
xor eax, eax
jmp 0x100c1e8
push eax
call fcn.0100b2fa
pop ecx
jmp 0x100c1e5
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi]
add dword [ebp - 0xc], eax
test byte [ecx + esi + 4], 0x80
je 0x100c1cf
test eax, eax
je 0x100c0e2
cmp byte [ebx], 0xa
jne 0x100c0e2
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x100c0eb
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, eax
cmp eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jae 0x100c1c9
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x1a
je 0x100c1b9
cmp al, 0xd
je 0x100c11d
mov byte [ebx], al
inc ebx
inc dword [ebp - 8]
jmp 0x100c1ab
dec ecx
cmp dword [ebp - 8], ecx
jae 0x100c137
mov eax, dword [ebp - 8]
inc eax
cmp byte [eax], 0xa
jne 0x100c132
add dword [ebp - 8], 2
jmp 0x100c18b
mov dword [ebp - 8], eax
jmp 0x100c1a7
inc dword [ebp - 8]
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100c15f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100c1a7
cmp dword [ebp - 0x10], 0
je 0x100c1a7
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x100c180
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x100c18b
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x100c1aa
cmp ebx, dword [ebp + 0xc]
jne 0x100c190
cmp byte [ebp - 1], 0xa
jne 0x100c190
mov byte [ebx], 0xa
jmp 0x100c1aa
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0100b832
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x100c1ab
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 8], ecx
jb 0x100c101
jmp 0x100c1c9
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x100c1c9
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
jmp 0x100c1e8
and dword [0x100f7b8], 0
mov dword [0x100f7b4], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100c81d
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, dword [0x1010d08]
jae 0x100c978
mov eax, ebx
sar eax, 5
mov eax, dword [eax*4 + 0x1010d20]
mov ecx, ebx
and ecx, 0x1f
test byte [eax + ecx*8 + 4], 1
je 0x100c978
push 1
push esi
push ebx
call fcn.0100ad93
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x100c982
push 2
push esi
push ebx
call fcn.0100ad93
add esp, 0xc
cmp eax, 0xffffffff
je 0x100c982
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x100c925
push 0x1000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [ebp + 8], eax
jne 0x100c8bb
mov dword [0x100f7b4], 0xc
or esi, 0xffffffff
jmp 0x100c965
push 0x8000
push ebx
call fcn.0100ce9b
pop ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, 0x1000
cmp edi, eax
jge 0x100c8d6
mov eax, edi
push eax
push dword [ebp + 8]
push ebx
call fcn.01009be1
add esp, 0xc
cmp eax, 0xffffffff
je 0x100c8f0
sub edi, eax
test edi, edi
jg 0x100c8cb
jmp 0x100c906
cmp dword [0x100f7b8], 5
jne 0x100c903
mov dword [0x100f7b4], 0xd
or esi, 0xffffffff
push dword [ebp - 4]
push ebx
call fcn.0100ce9b
pop ecx
pop ecx
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100c965
jge 0x100c965
push 0
push dword [ebp + 0xc]
push ebx
call fcn.0100ad93
push ebx
call fcn.0100b514
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, 0xffffffff
jne 0x100c965
mov dword [0x100f7b4], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x100f7b8], eax
push 0
push dword [ebp - 8]
push ebx
call fcn.0100ad93
add esp, 0xc
mov eax, esi
pop edi
jmp 0x100c985
mov dword [0x100f7b4], 9
or eax, 0xffffffff
pop esi
pop ebx
leave
ret

Function at 0x100cbc7
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 4
pop eax
call fcn.010074e0
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100cc2d
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x100f7c0]
mov esi, dword [ebp - 0x40]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
lea edx, [esi - 1]
and ecx, 0x103
not edx
and edx, ebx
inc ecx
sub edx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffff1
add eax, 0x11
imul eax, esi
add eax, edi
cmp edx, eax
jae 0x100cc31
xor eax, eax
jmp 0x100cc3e
lea eax, [ebp - 4]
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x50]
pop edi
pop esi
pop ebx
leave
ret