joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482b0c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1024], ebx
mov dword [ebp - 0x1020], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x482ce6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], esi
test esi, esi
jle 0x482cbc
xor edx, edx
mov eax, edi
call fcn.00482640
cmp esi, 0x1000
jle 0x482b64
mov dword [ebp - 0xc], 0x1000
jmp 0x482b67
mov dword [ebp - 0xc], esi
push 0
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x100c]
push eax
mov eax, dword [edi + 0x30]
push eax
call sub.wsock32.dll_recv
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x482bed
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x482cb4
mov eax, 0x482d00
mov dword [ebp - 0x101c], eax
mov byte [ebp - 0x1018], 0xb
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x1014], eax
mov byte [ebp - 0x1010], 0
lea eax, [ebp - 0x101c]
push eax
push 1
lea edx, [ebp - 0x1020]
mov eax, 0x48150c
call fcn.00406698
mov ecx, dword [ebp - 0x1020]
mov dl, 1
mov eax, dword [0x4078d8]
call fcn.0040c818
call fcn.004043d8
jmp 0x482cb4
test ebx, ebx
jne 0x482c1d
lea edx, [ebp - 0x1024]
mov eax, 0x481504
call fcn.00406698
mov ecx, dword [ebp - 0x1024]
mov dl, 1
mov eax, dword [0x4078d8]
call fcn.0040c7dc
call fcn.004043d8
jmp 0x482cb4
cmp ebx, 1
jge 0x482c36
mov ecx, 0x240
mov edx, 0x482d10
mov eax, 0x482d48
call fcn.004049d0
cmp ebx, 0x1000
jle 0x482c52
mov ecx, 0x241
mov edx, 0x482d10
mov eax, 0x482d48
call fcn.004049d0
cmp byte [ebp + 0xc], 0
je 0x482c7e
lea edx, [ebp - 0x100c]
mov eax, dword [edi + 0x4c]
mov eax, dword [eax + 8]
mov ecx, ebx
call fcn.00481294
lea edx, [ebp - 0x100c]
mov eax, dword [edi + 0x4c]
mov eax, dword [eax + 8]
mov ecx, ebx
call fcn.00481288
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.0041753c
sub esi, ebx
cmp byte [ebp + 8], 0
je 0x482cb4
mov dword [ebp - 0x1028], esi
fild dword [ebp - 0x1028]
fild dword [ebp - 8]
fdivp st(1)
fsubr dword [0x482d5c]
fstp dword [edi + 0x1bb0]
wait
test esi, esi
jg 0x482b4a
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482ced
lea eax, [ebp - 0x1024]
mov edx, 2
call fcn.00404a14
ret
Function at 0x1063e
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub edx, edx
inc edx
mov dword [ecx], eax
push esi
mov eax, dword [ecx]
push eax
pop esi
shr esi, 0x1e
sub esi, eax
imul esi, esi, 0x6c078965
sub ecx, 0xfffffffc
add esi, edx
inc edx
cmp edx, 0x270
mov dword [ecx], esi
jl 0x1064a
pop esi
pop ebp
ret 4

Function at 0x109b2
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
sub esi, esi
sub edx, edx
cmp dword [ebp + 0xc], esi
je 0x109da
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov cl, byte [edx + ecx]
add eax, esi
xor byte [eax], cl
lea eax, [edx + 1]
sub edx, edx
div dword [ebp + 0x14]
inc esi
cmp esi, dword [ebp + 0xc]
jne 0x109bf
pop esi
pop ebp
ret 0x10

Function at 0x13556
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push esi
pop ecx
call fcn.00013532
sub ecx, ecx
inc ecx
cmp dword [esi + 4], ecx
jbe 0x13582
mov eax, dword [esi]
lea eax, [eax + ecx*2]
mov dx, word [eax - 2]
xor word [eax], dx
inc ecx
cmp ecx, dword [esi + 4]
jb 0x13570
push dword [ebp + 0xc]
call fcn.0001da56
pop ecx
push esi
pop eax
pop esi
pop ebp
ret 0xc

Function at 0x1359a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push esi
pop ecx
call fcn.000134f0
sub ecx, ecx
inc ecx
cmp dword [esi + 4], ecx
jbe 0x135c3
mov eax, dword [esi]
add eax, ecx
mov dl, byte [eax - 1]
xor byte [eax], dl
inc ecx
cmp ecx, dword [esi + 4]
jb 0x135b4
push dword [ebp + 0xc]
call fcn.0001da56
pop ecx
push esi
pop eax
pop esi
pop ebp
ret 0xc

Function at 0x16d14
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0xc], 0
sub ecx, ecx
mov dword [ebp - 0x10], 1
sub eax, eax
mov dl, byte [eax + 0x73624]
xor byte [ebp + ecx - 0x10], dl
inc ecx
inc eax
and eax, 0xf
cmp ecx, 8
jne 0x16d29
push ecx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
mov dword [ebp - 4], 2
call fcn.0001340e
mov ecx, dword [0x777b4]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00016b32
push eax
pop ecx
call fcn.00011e06
mov ecx, dword [ebp - 8]
or ecx, ecx
je 0x16d74
call fcn.00010990
leave
ret
Function at 0x10186d6
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x108e558]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x78]
push eax
xor ebx, ebx
lea eax, [ebp - 0x70]
push eax
push ebx
push 0x2001d
push ebx
push ebx
push ebx
push 0x10016e8
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x64], ebx
call edi
mov esi, eax
cmp esi, ebx
jne 0x1018853
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
call edi
mov esi, eax
cmp esi, ebx
jne 0x1018853
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0xe
push 0x10016d4
push 2
push ebx
push 0x10016b4
push dword [ebp - 0x64]
call edi
mov esi, eax
cmp esi, ebx
jne 0x1018853
push 4
lea eax, [ebp - 0x74]
push eax
push 4
push ebx
push 0x10016a4
push dword [ebp - 0x64]
mov dword [ebp - 0x74], 1
call edi
mov esi, eax
cmp esi, ebx
jne 0x1018853
push 4
lea eax, [ebp - 0x74]
push eax
push 4
push ebx
push 0x1001688
push dword [ebp - 0x64]
mov dword [ebp - 0x74], 1
call edi
mov esi, eax
cmp esi, ebx
jne 0x1018853
mov edi, dword [ebp - 0x68]
cmp edi, ebx
je 0x1018853
jmp 0x10187c9
mov edi, dword [ebp - 0x68]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push dword [edi + 8]
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x1018846
mov esi, dword [edi + 4]
lea edi, [ebp - 0x60]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x60]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x50]
push eax
movsd dword es:[edi], dword [esi]
call fcn.010185c1
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x4a
lea eax, [ebp - 0x50]
push eax
push 1
push ebx
push 0x100167c
push dword [ebp - 0x6c]
call esi
mov edi, dword [ebp - 0x68]
push dword [edi + 0xc]
call fcn.0101e1a5
pop ecx
shl eax, 1
push eax
push dword [edi + 0xc]
push 1
push ebx
push 0x1001668
push dword [ebp - 0x6c]
call esi
push dword [ebp - 0x6c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [edi]
cmp edi, ebx
mov dword [ebp - 0x68], edi
jne 0x10187c6
cmp dword [ebp - 0x64], ebx
je 0x1018861
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x70], ebx
je 0x101886f
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.0101d2f1
leave
ret 8
Function at 0x1018abf
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
lea eax, [ebp - 0xc]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SystemCurrentControlSetControlPrint
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x1018bbf
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
push 4
pop edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.PipelineHostReuse
push dword [ebp - 0xc]
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1018b26
cmp dword [ebp - 4], ebx
jne 0x1018b26
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x40], bl
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.PipelineHostTimeout
push dword [ebp - 0xc]
mov dword [ebp - 8], edi
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x1018b54
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x1018b54
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x34], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.PipelineDebugLog
push dword [ebp - 0xc]
mov dword [ebp - 8], edi
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x1018b82
cmp dword [ebp - 4], ebx
je 0x1018b82
seta al
mov byte [0x10902d8], al
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.PipelineBufferSize
push dword [ebp - 0xc]
mov dword [ebp - 8], edi
mov dword [ebp - 4], ebx
call esi
test eax, eax
pop edi
pop esi
jne 0x1018bb1
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x1018bb1
mov dword [0x108e308], eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
cmp eax, ebx
pop ebx
jle 0x1018bcc
and eax, 0xffff
or eax, 0x80070000
leave
ret

Function at 0x1018fbe
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x1018fcd
push edi
push dword [ebp + 0xc]
push 7
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1019a45
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x108e558]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x208], esi
call fcn.01018f2c
cmp eax, esi
jne 0x1019ae6
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x1019a9d
lea eax, [ebp - 0x204]
push eax
call fcn.01019a45
cmp eax, esi
jne 0x1019ae5
lea eax, [ebp - 0x218]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x208]
mov dword [ebp - 0x20c], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x208]
je 0x1019a8d
call fcn.01018eb9
push dword [ebp - 0x210]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
lea ecx, [ebp - 0x208]
mov esi, eax
call fcn.01018eb9
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
call fcn.0101d2f1
leave
ret 4

Function at 0x101a063
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x108e558]
push esi
mov dword [ebp - 4], eax
call fcn.0105d64b
cmp byte [0x10902d8], 0
mov esi, dword [eax]
je 0x101a0c4
test esi, esi
je 0x101a0c4
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x101a09d
cmp byte [0x7ffe02d4], al
je 0x101a0c4
push esi
push 0x1001ac0
lea eax, [ebp - 0xcc]
push 0xc8
push eax
call fcn.01019e23
add esp, 0x10
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.0101d2f1
leave
ret

Function at 0x101a0d4
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
push esi
push esi
push esi
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, esi
mov dword [edi + 0x30], eax
jne 0x101a0f5
xor eax, eax
jmp 0x101a108
lea eax, [ebp - 4]
push eax
push esi
push edi
push 0x1019782
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
leave
ret
Function at 0x101bc97
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x107658e
call fcn.0101eabc
sub esp, 0x424
mov eax, dword [0x108e558]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x420], eax
call dword [0x108e300]
xor esi, esi
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0x424], ebx
jne 0x101bd15
call fcn.01018d79
mov esi, eax
jmp 0x101bddd
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
je 0x101bdaa
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
mov dword [ebp - 0x420], eax
je 0x101bdaa
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + edi + 2]
push eax
lea ecx, [ebp - 0x418]
mov dword [ebp - 0x41c], edi
mov byte [ebp - 4], 2
call fcn.01019f0b
jmp 0x101bd74
cmp dword [ebp - 0x418], esi
mov dword [ebp - 4], 1
jne 0x101bd8a
mov esi, 0x8007000e
jmp 0x101bdd1
call dword [0x108e300]
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x420]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x101bdb1
call fcn.01018d79
jmp 0x101bdcf
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
mov word [eax + edi*2], si
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.0101ba82
mov esi, eax
push dword [ebp - 0x424]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x101bdf6
lea ecx, [ebp - 0x418]
call fcn.010196f0
lea ecx, [ebp - 0x428]
call fcn.01019600
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.0101d2f1
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x101c7c2
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push eax
mov ebx, 0x2001f
push ebx
push 0
push 0x10014dc
push SysReAllocStringLen
call edi
mov esi, eax
test esi, esi
jne 0x101c829
lea eax, [ebp + 8]
push eax
push ebx
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x101c822
push 0x1001fc8
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp + 8]
mov esi, eax
call edi
push dword [ebp - 4]
call edi
test esi, esi
jle 0x101c837
and esi, 0xffff
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x101cd9b
Capabilities:
Copy file
Get common file path

Disassembly:
mov eax, 0x1076670
call fcn.0101eabc
sub esp, 0x53c
mov eax, dword [0x108e558]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push edi
mov dword [ebp - 0x4e4], eax
mov edi, 0x104
push edi
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x101ce30
push 0x5e
push 0x1001dd8
lea ecx, [ebp - 0x480]
call fcn.0105cd3b
and dword [ebp - 4], 0
call fcn.01018d79
push eax
lea ecx, [ebp - 0x480]
call fcn.0105cff5
push 0x10021fc
lea eax, [ebp - 0x480]
push eax
call fcn.0105cf3a
pop ecx
pop ecx
lea eax, [ebp - 0x480]
push eax
lea ecx, [ebp - 0x4e0]
call fcn.0101c3dd
push 0x107e340
lea eax, [ebp - 0x4e0]
jmp 0x101cfd7
push ebx
push esi
push 0x10021e0
push edi
lea eax, [ebp - 0x420]
push eax
call fcn.0101c95e
xor ebx, ebx
cmp eax, ebx
jge 0x101ce57
push 0x63
push 0x1001dd8
push eax
call fcn.0105c842
push edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x101ce9d
push 0x70
push 0x1001dd8
lea ecx, [ebp - 0x480]
call fcn.0105cd3b
mov dword [ebp - 4], 1
call fcn.01018d79
push eax
lea ecx, [ebp - 0x480]
call fcn.0105cff5
push 0x10021c4
jmp 0x101ce00
mov esi, str.msxpsdrv.inf
push esi
lea eax, [ebp - 0x218]
push eax
push 0x10021b0
push edi
push eax
call fcn.01019e51
add esp, 0x14
cmp eax, ebx
mov edi, 0x1001dd8
jge 0x101cecb
push 0x77
push edi
push eax
call fcn.0105c842
push esi
push dword [ebp - 0x4e4]
call fcn.0101cc49
push eax
lea ecx, [ebp - 0x4e8]
call fcn.0101cc0e
mov eax, dword [ebp - 0x4e8]
push ebx
lea ecx, [ebp - 0x218]
push ecx
push eax
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x101cf40
push 0x7f
push edi
lea ecx, [ebp - 0x480]
call fcn.0105cd3b
mov byte [ebp - 4], 3
call fcn.01018d79
push eax
lea ecx, [ebp - 0x480]
call fcn.0105cff5
push esi
lea eax, [ebp - 0x480]
push 0x100219c
push eax
call fcn.0105cf3a
add esp, 0xc
jmp 0x101ce0e
push 0x1002180
push dword [ebp - 0x4e4]
call fcn.0101cc49
push eax
lea ecx, [ebp - 0x4e4]
call fcn.0101cc0e
mov eax, dword [ebp - 0x4e4]
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea ecx, [ebp - 0x420]
push ecx
push eax
mov byte [ebp - 4], 4
call dword [sym.imp.SETUPAPI.dll_SetupCopyOEMInfW]
test eax, eax
pop esi
pop ebx
jne 0x101cfdd
push 0x88
push edi
lea ecx, [ebp - 0x4e0]
call fcn.0105cd3b
mov byte [ebp - 4], 5
call fcn.01018d79
push eax
lea ecx, [ebp - 0x4e0]
call fcn.0105cff5
lea eax, [ebp - 0x4e0]
push 0x1002168
push eax
call fcn.0105cf3a
pop ecx
pop ecx
lea eax, [ebp - 0x4e0]
push eax
lea ecx, [ebp - 0x548]
call fcn.0101c3dd
push 0x107e340
lea eax, [ebp - 0x548]
push eax
call fcn.0101e3fa
lea ecx, [ebp - 0x4e4]
call fcn.0101cbe9
lea ecx, [ebp - 0x4e8]
call fcn.0101cbe9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
call fcn.0101d2f1
leave
ret 4
Function at 0x101dc21
Capabilities:
Parse pe header

Disassembly:
push 0x60
push 0x1002348
call fcn.0101de00
mov edi, 0x94
mov eax, edi
call fcn.0101e440
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x109036c], ecx
mov eax, dword [esi + 4]
mov dword [0x1090378], eax
mov edx, dword [esi + 8]
mov dword [0x109037c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x1090370], esi
cmp ecx, 2
je 0x101dc81
or esi, 0x8000
mov dword [0x1090370], esi
shl eax, 8
add eax, edx
mov dword [0x1090374], eax
cmp word [0x1000000], 0x5a4d
jne 0x101dcbe
mov eax, dword [0x100003c]
cmp dword [eax + 0x1000000], 0x4550
jne 0x101dcbe
movzx ecx, word [eax + 0x1000018]
cmp ecx, 0x10b
je 0x101dcd7
cmp ecx, 0x20b
je 0x101dcc4
and dword [ebp - 0x1c], 0
jmp 0x101dcee
cmp dword [eax + 0x1000084], 0xe
jbe 0x101dcbe
xor ecx, ecx
cmp dword [eax + 0x10000f8], ecx
jmp 0x101dce8
cmp dword [eax + 0x1000074], 0xe
jbe 0x101dcbe
xor ecx, ecx
cmp dword [eax + 0x10000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
push 1
call fcn.010203ce
pop ecx
test eax, eax
jne 0x101dd02
push 0x1c
call fcn.0101dbf3
pop ecx
call fcn.01020340
test eax, eax
jne 0x101dd13
push 0x10
call fcn.0101dbf3
pop ecx
and dword [ebp - 4], 0
call fcn.0102008a
test eax, eax
jge 0x101dd28
push 0x1b
call fcn.0101dbc4
pop ecx
call fcn.0101ffda
mov dword [0x1092790], eax
call fcn.0101fe3b
mov dword [0x109035c], eax
call fcn.0101fd9e
test eax, eax
jge 0x101dd4d
push 8
call fcn.0101dbc4
pop ecx
call fcn.0101fb5d
test eax, eax
jge 0x101dd5e
push 9
call fcn.0101dbc4
pop ecx
call fcn.0101f610
mov dword [ebp - 0x28], eax
test eax, eax
je 0x101dd71
push eax
call fcn.0101dbc4
pop ecx
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call fcn.0101fb04
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x101dd93
movzx eax, word [ebp - 0x40]
jmp 0x101dd96
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push 0
push 0x1000000
call fcn.0101c307
mov esi, eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x1c], 0
jne 0x101ddb7
push esi
call fcn.0101f707
call fcn.0101f73f
jmp 0x101dde9
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x7c]
call fcn.0101de3b
ret
Function at 0x101f76e
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x108e558]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x108e5e0]
je 0x101f798
inc eax
cmp eax, 0x12
jb 0x101f789
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x108e5e0]
mov dword [ebp - 0x110], esi
jne 0x101f943
mov eax, dword [0x1090360]
cmp eax, 1
je 0x101f911
test eax, eax
jne 0x101f7ce
cmp dword [0x108e5c0], 1
je 0x101f911
cmp ecx, 0xfc
je 0x101f943
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x101f809
push 5
pop ecx
mov esi, 0x100275c
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebx, [ebp - 0x10c]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101f814
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x101f84c
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101f82c
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x1002758
push ebx
call fcn.010241f0
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101f851
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x110]
mov eax, dword [eax + 0x108e5e4]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x101f86b
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.0101e440
mov edx, esp
push 6
pop ecx
mov esi, 0x100273c
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101f897
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x101f8a3
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x101f8bc
mov eax, dword [ebp - 0x110]
mov esi, 0x1002738
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 0x108e5e4]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101f8da
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x101f8e6
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x1002710
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.010240e3
add esp, 0xc
jmp 0x101f943
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x101f943
mov esi, dword [esi + 0x108e5e4]
mov ecx, esi
lea edx, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x101f928
push 0
sub ecx, edx
lea edx, [ebp - 0x114]
push edx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x120]
mov ecx, dword [ebp - 4]
call fcn.0101d2f1
pop edi
pop esi
pop ebx
leave
ret