joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459544
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x45954c
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x459722
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40d698]
call fcn.00402e28
mov esi, eax
mov dword [ebp - 0x10], 1
mov ebx, 0x43
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00403d0c
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x459738
call fcn.00403e30
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00403d0c
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov edx, 0x459744
call fcn.00403e30
mov eax, dword [ebp - 4]
call fcn.00403fa8
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 3
jne 0x4596e9
mov eax, dword [0x45b9c4]
mov eax, dword [eax]
mov edx, 0x459750
call fcn.00403ef4
jne 0x45966a
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x40]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00459038
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x4596e9
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4596e9
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x20]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x10]
call fcn.00408cb8
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x45975c
call fcn.00403e30
mov edx, dword [ebp - 0x24]
pop eax
call fcn.00459934
inc dword [ebp - 0x10]
mov eax, dword [0x45ba8c]
mov eax, dword [eax]
call fcn.004473a8
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x45961c
jmp 0x4596e9
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x40]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00459038
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x4596e9
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4596e9
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0xc]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x2c]
push eax
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x10]
call fcn.00408cb8
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
mov edx, 0x45975c
call fcn.00403e30
mov edx, dword [ebp - 0x30]
pop eax
call fcn.00459798
inc dword [ebp - 0x10]
mov eax, dword [0x45ba8c]
mov eax, dword [eax]
call fcn.004473a8
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x45969d
inc ebx
cmp ebx, 0x57
jne 0x45957f
mov eax, esi
call fcn.00402e58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459729
lea eax, [ebp - 0x34]
mov edx, 8
call fcn.00403b88
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b88
ret

Function at 0x408946
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
and esi, edi
mov edi, esi
call fcn.00408965
or edi, esi
and edi, edi
xor dword [edx], ebx
push edi
pop edi
inc edx
cmp edx, eax
jne fcn.00408946
ret
Function at 0x1000f500
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1000f5be
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1000f57a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x11
jmp 0x1000f55c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0x17
je 0x1000f578
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1000f576
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x1000f551
jmp 0x1000f5bc
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x34]
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x3c]
call fcn.1001641e
mov ecx, eax
call fcn.1001629d
jmp 0x1000f5e8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push 0x5466
push 0
call fcn.1000c561
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x100103a4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a8a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x90
push esi
push edi
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10010413
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x2c]
push dword [ebp - 0x20]
push 0x791e
push dword [ebp - 0x34]
push 0x62ef
push 0x41d5
push dword [ebp - 0x18]
push 1
push 0x486a
call fcn.10010547
add esp, 0x24
jmp 0x10010537
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1001043a
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x10010537
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x50], 0x5e7a
mov dword [ebp - 0x6c], 0xfffffff6
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x4c], 0x2304b25b
mov dword [ebp - 0x48], 0x2304b25b
mov dword [ebp - 0x44], 0x2304b25b
mov dword [ebp - 0x40], 0x2304b25b
lea ecx, [ebp - 0xd]
call fcn.100163b3
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x90]
call fcn.100163b6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7c]
call fcn.10016362
and dword [ebp - 4], 0
push 3
lea ecx, [ebp - 0x68]
call fcn.10016326
mov byte [ebp - 4], 1
mov dword [ebp - 0x5c], 0x57ea
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 0x70], 1
lea eax, [ebp - 0x68]
push eax
push 0x6094
push 0x6322
push 0x760c
lea eax, [ebp - 0x54]
push eax
push 0
call fcn.1000ca94
add esp, 0x18
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x68]
call fcn.10016388
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.10016388
lea eax, [ebp - 0x9c]
push eax
call fcn.1000a60c
pop ecx
mov esi, eax
lea edi, [ebp - 0x88]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
call fcn.1000c303
shl eax, 1
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x80]
mov eax, dword [edx + eax*4 + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100120d7
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10012134
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001210e
push 0
push 0x2285
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x10012132
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 0
mov ecx, dword [ebp - 0x14]
call fcn.100163a4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x10012148
push 0x4fda
push 0
push 0x7b61
call fcn.1000cac1
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x100137e4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10013815
lea eax, [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
push dword [eax]
push 1
call fcn.1001390a
add esp, 0xc
jmp 0x10013906
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10013885
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x10013859
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0xffffffef
jg 0x10013880
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001387e
push 0x9dc
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x1001384e
jmp 0x10013906
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100138b3
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jg 0x10013906
push 0x3e5d
push dword [ebp - 0x34]
push 0x7f41
push 0x6042
push 0x7ed9
push 0x2d43
push 0
push 0x78b0
push 0x784a
push 0x1e36
push 1
push 0x49dc
push 0x76d3
push 0x6db7
push dword [ebp - 8]
call fcn.1000e336
add esp, 0x3c
jmp 0x100138a8
mov esp, ebp
pop ebp
ret
Function at 0x1001d973
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x1001da8b
push ebx
push edi
push dword [esi]
xor ebx, ebx
push ebx
push dword [esi + 4]
call fcn.1004c3e2
add esp, 0xc
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x10], 0x6c74aa0d
lea ecx, [ebp - 0x20]
push 3
call fcn.10016326
push 1
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 8], ebx
pop edi
jmp 0x1001d9ca
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
mov dword [eax + ecx*4], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x1001d9be
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001d9e6
push ebx
push ebx
push ebx
push 0x11d4
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
cmp dword [ebp - 0xc], ebx
je 0x1001d9f6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jne 0x1001d9f8
mov edi, ebx
mov eax, dword [ebp - 0xc]
xor edx, edx
sub edi, eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
lea ecx, [ebp - 0x20]
setne dl
mov dword [ebp - 0x14], edx
call fcn.10016388
push dword [esi + 4]
call fcn.10053859
mov dword [ebp - 0xc], 0x76820624
pop ecx
mov dword [ebp - 0xc], 0xffffffe5
jmp 0x1001da65
mov dword [ebp - 8], 3
mov dword [ebp - 8], ebx
jmp 0x1001da5c
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001da59
push 0x9dc
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffef
jle 0x1001da43
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffffb
jle 0x1001da37
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001da84
push 0x8b5
push 0x108b
push ebx
call dword [sym.imp.USER32.dll_EnableMenuItem]
pop edi
mov dword [esi + 4], ebx
mov dword [esi], ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10023ec9
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10023f33
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10023f15
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10023f13
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x10023f31
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 1
mov ecx, dword [ebp - 0x1c]
call fcn.100163a4
mov dword [eax], 0xf3922cbd
jmp 0x10023f54
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push 0x5eef
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.100289fa
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x10024927
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100249a3
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10024990
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
add ecx, dword [eax]
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x100249a1
push 0x9dc
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x100249b7
push 0xd21
push 0x3051
push 0
call fcn.10026146
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x100249da
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006afa7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10024aba
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10024a2d
push 0x9dc
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x10024ab8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xfffffff3
jmp 0x10024a4f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0xc
jge 0x10024ab8
push 1
lea ecx, [ebp - 0x34]
call fcn.10016326
and dword [ebp - 4], 0
push 0
push 1
lea eax, [ebp - 0x34]
push eax
push 0x48cb
lea eax, [ebp - 0x28]
push eax
push 0x594e
push 0x5e52
push 0x402d
call fcn.1002460f
add esp, 0x20
push 0
lea ecx, [ebp - 0x34]
call fcn.100163a4
cmp dword [eax], 0
je 0x10024aaa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10016388
jmp 0x10024ab8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10016388
jmp 0x10024a44
jmp 0x10024ae0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
push 1
push 0x5051
push 0x3821
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.1002436b
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10024b06
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006afb1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10024c60
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10024c06
mov dword [ebp - 0x20], 0x45c8
mov dword [ebp - 0x28], 0x10008168
cmp dword [ebp - 0x20], 0x4763
jle 0x10024bbe
and dword [ebp - 0x18], 0
jmp 0x10024b78
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7f58
jge 0x10024bb8
and dword [ebp - 0x1c], 0
jmp 0x10024b8e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x72c4
jge 0x10024bb6
mov eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov ecx, 0x106127f8
call fcn.1001600c
jmp 0x10024b87
jmp 0x10024b71
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x431e
jge 0x10024bde
mov edx, dword [ebp - 0x28]
mov ecx, 0x106127f8
call fcn.1001a94a
jmp 0x10024bfa
or dword [ebp - 4], 0xffffffff
jmp 0x10024c04
jmp 0x10024c5e
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x10024c34
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0x17
jne 0x10024c5e
mov dword [ebp - 0x40], 0xe566
push dword [ebp - 0x3c]
lea eax, [ebp - 0x40]
push eax
push 0
push 0x5339
push dword [ebp - 0x14]
call fcn.10024c7f
add esp, 0x14
jmp 0x10024c29
jmp 0x10024c6e
push 0
push 0x2940
call fcn.1002a19f
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029b36
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10029b82
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 1
push 0x2d09
call fcn.10029bf5
add esp, 0x1c
jmp 0x10029bf1
lea eax, [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10029beb
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10029bcc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x10029be9
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.100163a4
mov dword [eax], 0xfffd
jmp 0x10029bc1
jmp 0x10029bf1
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esp, ebp
pop ebp
ret

Function at 0x1002b422
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002b4a5
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002b458
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x1002b4a3
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002b486
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1002b4a3
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.100163a4
mov dword [eax], 0xfffffffd
jmp 0x1002b47b
jmp 0x1002b4c2
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
push 0
push dword [ebp - 0x20]
push 0x485d
push 0x2d19
call fcn.10033be7
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1002c179
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002c1db
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002c1ad
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x1002c1d9
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002c1d9
push 1
push 0x6ca6
push 1
push 0x4cda
call fcn.10024b06
add esp, 0x10
jmp 0x1002c1f7
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 1
call fcn.10026146
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10032878
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100328fa
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x100328aa
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x100328f5
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100328d8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x100328f5
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.100163a4
mov dword [eax], 0x55b7cefa
jmp 0x100328cd
jmp 0x1003298d
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10032969
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1003294a
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x10032967
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.100163a4
mov dword [eax], 0x2e56
jmp 0x1003293f
jmp 0x1003298d
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
push 0
mov ecx, dword [ebp - 0x48]
call fcn.100163a4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret