joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005f07
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10080d8]
jne 0x1005f18
test ecx, 0xffff0000
jne 0x1005f18
ret
jmp fcn.01005f22

Function at 0x1006007
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1001478
call fcn.0100622c
cmp word [0x1000000], 0x5a4d
jne 0x1006046
mov eax, dword [0x100003c]
cmp dword [eax + 0x1000000], 0x4550
jne 0x1006046
movzx ecx, word [eax + 0x1000018]
cmp ecx, 0x10b
je 0x100605f
cmp ecx, 0x20b
je 0x100604c
and dword [ebp - 0x1c], 0
jmp 0x1006076
cmp dword [eax + 0x1000084], 0xe
jbe 0x1006046
xor ecx, ecx
cmp dword [eax + 0x10000f8], ecx
jmp 0x1006070
cmp dword [eax + 0x1000074], 0xe
jbe 0x1006046
xor ecx, ecx
cmp dword [eax + 0x10000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
and dword [ebp - 4], 0
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1008564], 0xffffffff
or dword [0x1008568], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1008558]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1008554]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1008560], eax
call fcn.01006224
cmp dword [0x10080dc], 0
jne 0x10060d3
push fcn.01006224
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100620d
push 0x1001168
push 0x1001164
call sub.msvcrt.dll__initterm
mov eax, dword [0x1008550]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x100854c]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x34], eax
push 0x1001160
push 0x100113c
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___winitenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01004195
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], 0
jne 0x100614b
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1006180
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01006267
ret

Function at 0x10071c0
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
push 1
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x1007247
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
push 0
shl eax, 8
push eax
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
test eax, eax
mov dword [esi + 4], eax
je 0x100721e
mov ecx, dword [section..data]
cmp byte [ecx + 0x19], 5
jb 0x1007247
push eax
push 0x10014a0
push 0x10
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01003cc1
jmp 0x1007247
mov eax, dword [section..data]
cmp byte [eax + 0x19], 2
jb 0x1007247
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [section..data]
push 0x10014a0
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01003cc1
pop esi
leave
ret
Function at 0x40101f
Capabilities:
Get common file path
Set registry value

Disassembly:
call 0x40101f
or eax, eax
je 0x401018
push 0x40
push 0x403118
push eax
push 0
call sub.user32.dll_MessageBoxA
push 0
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffff34
push esi
push edi
push 0x80
push 0x403130
call sub.kernel32.dll_GetSystemDirectoryA
or eax, eax
je 0x40105d
cmp byte [eax + 0x40312f], 0x5c
je 0x40105d
cmp byte [eax + 0x403130], 0
jne 0x40105d
mov byte [eax + 0x403130], 0x5c
mov byte [eax + 0x403131], 0
cmp byte [0x403001], 0
je 0x40112d
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0xc4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x40112d
push 0x403130
lea eax, [ebp - 0x80]
push eax
call sub.kernel32.dll_lstrcpyA
push str.ImeRovasoft_
lea eax, [ebp - 0x80]
push eax
call sub.kernel32.dll_lstrcatA
lea esi, str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
lea esi, [esi + 0x34]
push esi
lea eax, [ebp - 0x80]
push eax
call sub.kernel32.dll_lstrcatA
push str.WbjjUninst.exe
lea eax, [ebp - 0x80]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x80]
push eax
call sub.kernel32.dll_lstrlenA
inc eax
mov dword [ebp - 0xcc], eax
push 0x1e
push 0x403085
push 1
push 0
push str.DisplayName
push dword [ebp - 0xc4]
call sub.advapi32.dll_RegSetValueExA
push dword [ebp - 0xcc]
lea eax, [ebp - 0x80]
push eax
push 1
push 0
push str.UninstallString
push dword [ebp - 0xc4]
call sub.advapi32.dll_RegSetValueExA
push dword [ebp - 0xc4]
call sub.advapi32.dll_RegCloseKey
push 0x403130
lea eax, [ebp - 0xc0]
push eax
call sub.kernel32.dll_lstrcpyA
push str.jpwb.IME
lea eax, [ebp - 0xc0]
push eax
call sub.kernel32.dll_lstrcatA
push 0x403012
lea eax, [ebp - 0xc0]
push eax
call sub.imm32.dll_ImmInstallIMEA
or eax, eax
je 0x40116b
mov eax, 0x403033
jmp 0x401170
mov eax, 0x40305c
cmp byte [section..data], 0
jne 0x40117b
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1001c2e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100f0a88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x90
push ebx
mov ebx, ecx
push esi
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0xc]
push edi
mov dword [esp + 0xc], 0x3f800000
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
push 0
mov dword [esp + 0x20], ecx
push 0x3f800000
push 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], edx
call fcn.1000d370
mov ecx, dword [eax]
push 0x3f800000
mov dword [esp + 0x28], ecx
push 0
mov edx, dword [eax + 4]
push 0
lea ecx, [esp + 0x9c]
mov dword [esp + 0x34], edx
mov eax, dword [eax + 8]
mov dword [esp + 0x38], eax
call fcn.1000d370
mov ecx, dword [eax]
mov esi, dword [esp + 0xac]
mov dword [esp + 0x30], ecx
push 0
mov edx, dword [eax + 4]
mov cl, byte [esi]
mov dword [esp + 0x38], edx
mov dword [esp + 0x40], 0
mov eax, dword [eax + 8]
mov byte [esp + 0x54], cl
lea ecx, [esp + 0x54]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
call fcn.10002040
mov edx, dword [0x100f7360]
lea ecx, [esp + 0x50]
push edx
push 0
push esi
call fcn.10001ec4
mov ecx, 0xc
lea esi, [esp + 0x18]
lea edi, [esp + 0x60]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x50]
lea ecx, [esp + 0x48]
push eax
push ecx
mov ecx, ebx
mov dword [esp + 0xac], 0
call fcn.1001efe0
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x54]
test eax, eax
mov dword [esp + 0x4c], edx
je 0x1001c41b
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x1001c412
cmp al, 0xff
je 0x1001c412
dec al
mov byte [ecx], al
jmp 0x1001c41b
push ecx
call fcn.100d0293
add esp, 4
mov ecx, dword [esp + 0x9c]
lea eax, [esi + 0x1c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x9c
ret 4
Function at 0x10033250
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x5c]
mov ebx, dword [esi + 4]
cmp eax, edi
mov dword [esi], 0x100f742c
jge 0x10033287
lea eax, [esp + 0xc]
push 4
push eax
push 0xffffff7f
push 0xffff
push ebx
mov dword [esp + 0x20], 1
call sub.WSOCK32.dll_setsockopt
push ebx
call sub.WSOCK32.dll_closesocket
mov eax, dword [esi + 0x1c]
push eax
mov dword [esp + 0x10], eax
call fcn.100d0293
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov eax, dword [esi + 0xc]
push eax
mov dword [esp + 0x14], eax
call fcn.100d0293
add esp, 8
mov ecx, esi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
call fcn.10038540
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10033810
Capabilities:
Set socket configuration

Disassembly:
push 0xffffffffffffffff
push 0x100f1a58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x100f7440
mov eax, dword [esi + 8]
mov dword [esp + 0x20], 0
test eax, eax
je 0x10033891
lea edi, [eax + 8]
push ebx
lea eax, [esp + 0xc]
push ebp
push eax
mov ecx, edi
mov dword [esp + 0x14], esi
call fcn.10037fb0
lea ecx, [esp + 0x10]
mov ebp, eax
push ecx
mov ecx, edi
call fcn.10037f60
mov ebx, eax
cmp ebx, ebp
mov dword [esp + 0x14], ebx
je 0x10033881
lea ecx, [esp + 0x14]
call fcn.10038000
cmp dword [esp + 0x14], ebp
jne 0x10033872
push ebp
lea edx, [esp + 0x20]
push ebx
push edx
mov ecx, edi
call fcn.10035b40
pop ebp
pop ebx
mov eax, dword [esi + 0xc]
mov edi, dword [esi + 4]
test eax, eax
jge 0x100338ba
lea eax, [esp + 0xc]
push 4
push eax
push 0xffffff7f
push 0xffff
push edi
mov dword [esp + 0x20], 1
call sub.WSOCK32.dll_setsockopt
push edi
call sub.WSOCK32.dll_closesocket
mov ecx, esi
mov dword [esp + 0x20], 0xffffffff
call fcn.10038540
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x10033b10
Capabilities:
Set socket configuration

Disassembly:
push 0xffffffffffffffff
push 0x100f1a7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esi + 0x14]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x18], ebx
je 0x10033b54
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
je 0x10033b4f
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [esi + 0x14], ebx
jne 0x10033b3d
mov eax, dword [esi]
push edi
mov edi, dword [esi + 4]
cmp eax, ebx
jge 0x10033b7d
lea ecx, [esp + 0xc]
push 4
push ecx
push 0xffffff7f
push 0xffff
push edi
mov dword [esp + 0x20], 1
call sub.WSOCK32.dll_setsockopt
push edi
call sub.WSOCK32.dll_closesocket
mov eax, dword [esi + 0xc]
add esi, 8
push eax
lea edx, [esp + 0x14]
mov ecx, dword [eax]
mov dword [esp + 0x20], 0xffffffff
push ecx
push edx
mov ecx, esi
call fcn.10035b40
mov eax, dword [esi + 4]
push eax
call fcn.100d0293
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
call fcn.100d01e2
mov eax, dword [0x10116a7c]
pop edi
dec eax
mov dword [0x10116a7c], eax
jne 0x10033bdf
mov ecx, dword [0x10116a78]
push ecx
call fcn.100d0293
add esp, 4
mov dword [0x10116a78], ebx
lea ecx, [esp + 8]
call fcn.100d027e
mov ecx, dword [esp + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10033c00
Capabilities:
Get socket status

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100f1a9e
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push ebx
mov ebx, ecx
push ebp
xor ebp, ebp
mov eax, dword [ebx]
push edi
cmp eax, ebp
je 0x10033c2f
xor eax, eax
jmp 0x10033d69
mov eax, dword [ebx + 4]
mov ecx, 0x3f
mov dword [esp + 0x38], eax
xor eax, eax
lea edi, [esp + 0x3c]
mov dword [esp + 0x34], 1
rep stosd dword es:[edi], eax
mov ecx, dword [0x10116a58]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 0x14], edx
mov ecx, 0x3e8
cdq
idiv ecx
lea ecx, [esp + 0x34]
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
lea eax, [esp + 0x14]
push eax
push ebp
push ebp
push ecx
shl edx, 3
push ebp
mov dword [esp + 0x2c], edx
call sub.WSOCK32.dll_select
cmp eax, ebp
jne 0x10033c9d
xor eax, eax
jmp 0x10033d69
cmp eax, 1
je 0x10033caf
mov dword [ebx], 0xffffffff
xor eax, eax
jmp 0x10033d69
mov edx, dword [ebx + 4]
push ebp
push ebp
push edx
call sub.WSOCK32.dll_accept
mov edi, eax
cmp edi, 0xffffffff
jne 0x10033cca
mov dword [ebx], eax
xor eax, eax
jmp 0x10033d69
push esi
push 0x18
call fcn.100ddb25
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
cmp esi, ebp
mov dword [esp + 0x144], ebp
je 0x10033d41
mov ecx, esi
call fcn.10038490
lea eax, [esp + 0x14]
lea ecx, [esp + 0x28]
push eax
push ecx
push edi
mov dword [esi + 4], edi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebp
mov dword [esi], 0x100f7440
mov dword [esp + 0x20], 0x10
call sub.WSOCK32.dll_getpeername
test eax, eax
je 0x10033d20
mov dword [esi + 0x14], ebp
mov dword [esi + 0x10], ebp
jmp 0x10033d43
mov edx, dword [esp + 0x2c]
push edx
call sub.WSOCK32.dll_ntohl
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x2a]
push eax
call sub.WSOCK32.dll_ntohs
and eax, 0xffff
mov dword [esi + 0x14], eax
jmp 0x10033d43
xor esi, esi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
push edx
lea ecx, [ebx + 8]
mov dword [esp + 0x14c], 0xffffffff
mov dword [esp + 0x18], esi
call fcn.10035a10
mov eax, dword [esp + 0x10]
pop esi
mov ecx, dword [esp + 0x138]
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x138
ret
Function at 0x10048f10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100f2988
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x34]
push edi
mov edi, dword [esi + 0xb0]
mov eax, dword [esi + 0xa8]
add edi, ecx
cmp edi, eax
jge 0x100490e5
mov ecx, dword [esi + 0x98]
call fcn.100535f0
mov ecx, dword [esi + 0xa0]
add eax, edi
cmp eax, ecx
jle 0x100490e5
mov ecx, dword [esi + 0xac]
mov edx, dword [esp + 0x34]
mov eax, dword [esi + 0xa4]
add ecx, edx
cmp ecx, eax
mov dword [esp + 0x10], ecx
jge 0x100490e5
mov ebp, dword [esp + 0x3c]
xor ebx, ebx
mov eax, dword [ebp + 8]
test eax, eax
jbe 0x10048fd7
mov eax, dword [ebp + 4]
test eax, eax
jne 0x10048f9c
mov eax, 0x100f7364
jmp 0x10048f9e
add eax, ebx
movsx eax, byte [eax]
mov ecx, dword [esi + 0x98]
push eax
call fcn.10053440
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x9c]
add ecx, eax
cmp ecx, edx
jg 0x10048fd3
mov edx, dword [esp + 0x34]
mov dword [esp + 0x10], ecx
add edx, eax
mov eax, dword [ebp + 8]
inc ebx
mov dword [esp + 0x34], edx
cmp ebx, eax
jb 0x10048f8e
mov ecx, dword [esp + 0x10]
mov eax, dword [ebp + 8]
mov edi, ebx
cmp ebx, eax
jae 0x100490e5
jmp 0x10048fea
mov ecx, dword [esp + 0x10]
cmp ecx, dword [esi + 0xa4]
jge 0x10049023
mov eax, dword [ebp + 4]
test eax, eax
jne 0x10049000
mov eax, 0x100f7364
jmp 0x10049002
add eax, edi
movsx edx, byte [eax]
mov ecx, dword [esi + 0x98]
push edx
call fcn.10053440
mov edx, dword [esp + 0x10]
add edx, eax
mov eax, dword [ebp + 8]
inc edi
mov dword [esp + 0x10], edx
cmp edi, eax
jb 0x10048fe6
cmp edi, ebx
jle 0x100490e5
sub edi, ebx
lea eax, [esp + 0x14]
push edi
push ebx
push eax
mov ecx, ebp
call fcn.10001be6
mov ecx, dword [esp + 0x38]
mov edx, dword [esi + 0xc0]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov cl, byte [esi + 0x87]
push eax
mov eax, dword [esi + 0x78]
mov edi, dword [esi + 0x74]
and eax, edx
shr eax, cl
mov cl, byte [esi + 0x86]
and edi, edx
mov ebx, dword [esi + 0x7c]
mov dword [esp + 0x38], 0
shl eax, cl
mov cl, byte [esi + 0x85]
shr edi, cl
mov cl, byte [esi + 0x84]
shl edi, cl
mov cl, byte [esi + 0x83]
or eax, edi
mov edi, dword [esi + 0x70]
and edi, edx
shr edi, cl
mov cl, byte [esi + 0x82]
shl edi, cl
mov cl, byte [esi + 0x81]
or eax, edi
mov edi, dword [esi + 0x6c]
and edi, edx
shr edi, cl
mov cl, byte [esi + 0x80]
shl edi, cl
mov ecx, dword [esi + 0x98]
or eax, edi
or eax, ebx
push eax
push esi
call fcn.10053470
mov eax, dword [esp + 0x18]
test eax, eax
je 0x100490e5
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x100490dc
cmp al, 0xff
je 0x100490dc
dec al
mov byte [ecx], al
jmp 0x100490e5
push ecx
call fcn.100d0293
add esp, 4
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
Function at 0x1004ad30
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100f2adb
push eax
mov dword fs:[0], esp
mov eax, dword [esp + 0x10]
sub esp, 8
push ebx
mov ebx, dword [esp + 0x20]
push esi
mov esi, ecx
push edi
push esi
push ebx
push eax
call fcn.10056f80
mov edi, eax
test edi, edi
jne 0x1004ad77
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 8
push 0xcc
call fcn.100ddb25
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
mov dword [esp + 0x1c], 0
je 0x1004ada0
push ebx
push edi
push esi
mov ecx, eax
call fcn.10047530
jmp 0x1004ada2
xor eax, eax
lea ecx, [esp + 0x28]
lea edx, [esp + 0xc]
push ecx
push edx
lea ecx, [esi + 0x264]
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x30], eax
call fcn.1004c860
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x10052e70
Capabilities:
Log keystrokes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
lea eax, [esi - 0xc7]
cmp eax, 0xc
ja case.0x10052e81.202
jmp dword [eax*4 + 0x10053000]
pop edi
mov eax, 3
pop esi
ret 4
pop edi
mov eax, 4
pop esi
ret 4
pop edi
mov eax, 1
pop esi
ret 4
pop edi
mov eax, 2
pop esi
ret 4
pop edi
mov eax, 5
pop esi
ret 4
pop edi
mov eax, 6
pop esi
ret 4
pop edi
mov eax, 0x1c
pop esi
ret 4
pop edi
mov eax, 0x1d
pop esi
ret 4
pop edi
mov eax, 0x1f
pop esi
ret 4
pop edi
mov eax, 0x1e
pop esi
ret 4
and esi, 0x7f
push 1
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov edi, eax
test edi, edi
jne 0x10052f03
pop edi
pop esi
ret 4
mov ecx, dword [0x10116cf0]
push 0x2a
call fcn.10053270
mov ecx, dword [0x10116cf0]
push 0x36
neg al
sbb al, al
and eax, 0x80
mov byte [0x10116db0], al
call fcn.10053270
mov cl, byte [0x10116db0]
push 0x1d
neg al
sbb al, al
and eax, 0x80
mov byte [0x10116db1], al
or al, cl
mov ecx, dword [0x10116cf0]
mov byte [0x10116d20], al
call fcn.10053270
mov ecx, dword [0x10116cf0]
push 0x9d
neg al
sbb al, al
and eax, 0x80
mov byte [0x10116db2], al
call fcn.10053270
mov cl, byte [0x10116db2]
push 0x38
neg al
sbb al, al
and eax, 0x80
mov byte [0x10116db3], al
or al, cl
mov ecx, dword [0x10116cf0]
mov byte [0x10116d21], al
call fcn.10053270
mov ecx, dword [0x10116cf0]
push 0xb8
neg al
sbb al, al
and eax, 0x80
mov byte [0x10116db4], al
call fcn.10053270
mov cl, byte [0x10116db4]
push 0
neg al
sbb al, al
and eax, 0x80
mov byte [0x10116db5], al
or al, cl
mov byte [0x10116d22], al
lea eax, [esp + 0x10]
push eax
push 0x10116d10
push esi
push edi
call dword [sym.imp.USER32.dll_ToAscii]
cmp eax, 1
je 0x10052ff2
pop edi
xor eax, eax
pop esi
ret 4
mov eax, dword [esp + 0xc]
pop edi
and eax, 0xff
pop esi
ret 4
Function at 0x10053ba0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x100f320b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
push esi
lea eax, [esp + 0x20]
push edi
push eax
push 0x104
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x10053c3a
mov cl, byte [esp + 0xf]
push ebp
mov ebp, dword [esp + 0x13c]
push eax
mov byte [ebp], cl
mov ecx, ebp
call fcn.10002040
mov edi, 0x10115cbc
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
mov ecx, ebp
push ebx
call fcn.1000234b
test al, al
je 0x10053c32
mov edi, dword [ebp + 4]
mov ecx, ebx
mov edx, ecx
mov esi, 0x10115cbc
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 4]
mov dword [ebp + 8], ebx
mov byte [ebx + eax], 0
mov eax, ebp
pop ebp
jmp 0x10053d85
mov cl, byte [esp + 0xf]
push 0
mov byte [esp + 0x14], cl
lea ecx, [esp + 0x14]
call fcn.10002040
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
lea ecx, [esp + 0x14]
push ebx
call fcn.1000234b
test al, al
je 0x10053c8f
mov edi, dword [esp + 0x14]
mov ecx, ebx
mov edx, ecx
lea esi, [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call fcn.100044e0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x130], 0
test ecx, ecx
je 0x10053d34
lea esi, [ecx - 1]
cmp ecx, esi
jb 0x10053ce9
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10053ce9
mov dl, byte [eax - 1]
test dl, dl
je 0x10053cd5
cmp dl, 0xff
je 0x10053cd5
push 0
push ecx
lea ecx, [esp + 0x18]
call fcn.1000234b
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10053ce5
mov byte [eax - 1], 0xff
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
add eax, esi
jmp 0x10053cee
mov eax, 0x100f7364
cmp byte [eax], 0x5c
je 0x10053d34
mov eax, dword [0x100f7360]
sub eax, ecx
cmp eax, 1
ja 0x10053d08
call fcn.100d029e
mov ecx, dword [esp + 0x18]
lea esi, [ecx + 1]
push 0
push esi
lea ecx, [esp + 0x18]
call fcn.1000234b
test al, al
je 0x10053d34
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add edx, ecx
mov byte [edx], 0x5c
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], esi
mov byte [eax + esi], 0
mov esi, dword [esp + 0x138]
mov cl, byte [esp + 0x10]
push 0
mov byte [esi], cl
mov ecx, esi
call fcn.10002040
mov edx, dword [0x100f7360]
lea eax, [esp + 0x10]
push edx
push 0
push eax
mov ecx, esi
call fcn.10001ec4
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x10053d83
mov al, byte [ecx - 1]
test al, al
je 0x10053d79
cmp al, 0xff
je 0x10053d79
dec al
mov byte [ecx - 1], al
jmp 0x10053d83
dec ecx
push ecx
call fcn.100d0293
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x128]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x128
ret 4
Function at 0x10053e00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
test eax, eax
jne 0x10053e10
mov eax, 0x100f7364
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10053e21
xor eax, eax
ret 4
and al, 0x10
neg al
sbb eax, eax
neg eax
inc eax
ret 4
Function at 0x1005e6e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100f38b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.10069060
mov edi, eax
mov eax, dword [esp + 0x44]
mov edx, dword [0x100f7360]
xor ebx, ebx
push edx
mov cl, byte [eax]
push ebx
mov byte [esp + 0x28], cl
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call fcn.10001ec4
push edi
lea ecx, [esp + 0x34]
mov byte [esp + 0x40], 1
call fcn.10069220
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x44], 2
call fcn.1005f0b0
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x1c], edx
lea ecx, [esp + 0x30]
mov byte [esp + 0x3c], 3
call fcn.10069450
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x1005e797
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x1005e78e
cmp al, 0xff
je 0x1005e78e
dec al
mov byte [ecx], al
jmp 0x1005e797
push ecx
call fcn.100d0293
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x3c], 0xffffffff
call fcn.10069450
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x1c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 4