joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001aa1c
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001aa77
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001aa58
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1001aa75
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016fb3
mov dword [eax], 0x5c9e53e5
jmp 0x1001aa4d
jmp 0x1001aa95
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001aa95
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret

Function at 0x1001aa99
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001aaaf
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x1001aacc
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001aacc
push 1
push 0x7c1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
mov esp, ebp
pop ebp
ret

Function at 0x1001cc30
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001cc56
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1001cc74
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001cc74
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esp, ebp
pop ebp
ret

Function at 0x1001d856
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001d8b1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001d892
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001d8af
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016fb3
mov dword [eax], 0x23371247
jmp 0x1001d887
jmp 0x1001d8db
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001d8db
push 0x2302
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esp, ebp
pop ebp
ret
Function at 0x1001ddca
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001dde2
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1001de2d
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001de10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001de2d
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016fb3
mov dword [eax], 0x72fd
jmp 0x1001de05
mov esp, ebp
pop ebp
ret
Function at 0x10028ae3
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10028afb
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x10028b46
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10028b29
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x10028b46
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016fb3
mov dword [eax], 0x641cecc2
jmp 0x10028b1e
mov esp, ebp
pop ebp
ret

Function at 0x10029d3f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10029de8
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
push 4
pop eax
test eax, eax
je 0x10029dab
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x10029dab
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
je 0x10029dab
mov dword [ebp - 8], 1
jmp 0x10029daf
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
imul edx, dword [ebp - 8]
add edx, dword [ecx]
sub edx, dword [eax]
mov eax, dword [ebp - 4]
cmp dword [eax], edx
jge 0x10029dda
mov dword [ebp - 0x10], 1
jmp 0x10029dde
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
jmp 0x10029dfc
push 0x2302
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esp, ebp
pop ebp
ret
Function at 0x1002c07c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002c0b7
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
add eax, dword [ecx]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx], eax
jmp 0x1002c0c9
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esp, ebp
pop ebp
ret
Function at 0x1002d44a
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002d4a5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002d486
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1002d4a3
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016fb3
mov dword [eax], 8
jmp 0x1002d47b
jmp 0x1002d4ad
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esp, ebp
pop ebp
ret

Function at 0x1002d4b1
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1002d4d8
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002d4d3
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1002d562
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
push 0
mov ecx, dword [ebp - 0x24]
call fcn.10016fb3
mov dword [eax], 3
push 0xfffffffffffffffc
pop eax
cmp eax, 3
jg 0x1002d529
mov dword [ebp - 8], 1
jmp 0x1002d52d
and dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
cmp dword [eax], 1
jle 0x1002d53e
mov dword [ebp - 0x10], 1
jmp 0x1002d542
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
imul eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
imul ecx, dword [ebp - 0x10]
imul eax, ecx
imul eax, eax, 0x3c3
mov ecx, dword [ebp - 0x2c]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x1002ff17
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10030046
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jg 0x1002ff7b
mov dword [ebp - 0x20], 1
jmp 0x1002ff7f
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jle 0x1002ff94
mov dword [ebp - 0x14], 1
jmp 0x1002ff98
and dword [ebp - 0x14], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xfb2c41ac
jne 0x1002ffb7
mov dword [ebp - 0x18], 1
jmp 0x1002ffbb
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
inc eax
mov ecx, dword [ebp - 8]
cmp eax, dword [ecx]
jne 0x1002ffcf
mov dword [ebp - 0x1c], 1
jmp 0x1002ffd3
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x1c], eax
jle 0x1002ffe6
mov dword [ebp - 0x24], 1
jmp 0x1002ffea
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
jg 0x1002fffb
mov dword [ebp - 0x28], 1
jmp 0x1002ffff
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
jne 0x10030018
mov dword [ebp - 0x2c], 1
jmp 0x1003001c
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp dword [ebp - 0x2c], eax
jge 0x1003002f
mov dword [ebp - 0x48], 1
jmp 0x10030033
and dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
push 0
mov ecx, dword [ebp - 0x4c]
call fcn.10016fb3
mov dword [eax], esi
jmp 0x1003005a
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003005a
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10031765
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x100317d8
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
push dword [eax]
push 0x6f20
mov eax, dword [ebp - 0x20]
push dword [eax]
push 0x247e
push 1
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.10031520
add esp, 0x20
jmp 0x100317e2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esp, ebp
pop ebp
ret

Function at 0x100318d2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push 1
lea eax, [ebp + 8]
push eax
push 0x390d
lea eax, [ebp - 0x10]
push eax
call fcn.100316c1
add esp, 0x10
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10031907
xor eax, eax
jmp 0x10031a38
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10031709
add esp, 0x10
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1003192f
xor eax, eax
jmp 0x10031a38
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
push 1
call fcn.100307db
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x1003194d
xor eax, eax
jmp 0x10031a38
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10031765
add esp, 0x18
push dword [ebp - 8]
push 0xb4d
push dword [ebp + 8]
push 0x3f5b
push 0
push dword [ebp - 4]
push 0xba8
push 0x54c4
call fcn.10029f50
add esp, 0x20
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x100319b2
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0x14]
push eax
call fcn.100317e6
add esp, 0xc
push dword [ebp - 4]
call fcn.100306b0
pop ecx
test eax, eax
jne 0x100319c3
xor eax, eax
jmp 0x10031a38
lea eax, [ebp - 4]
push eax
push 0x1d94
push 0x19ae
push 1
call fcn.10031841
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10031a20
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x100319fa
xor eax, eax
jmp 0x10031a38
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10031a13
xor eax, eax
jmp 0x10031a38
push 1
lea eax, [ebp - 4]
push eax
call fcn.10031897
pop ecx
pop ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10031a31
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10031a35
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10044f63
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10045001
mov dword [ebp - 8], 1
mov dword [ebp - 0x10], 0x37400631
mov dword [ebp - 0x18], 0xe8b0d193
mov dword [ebp - 0x20], 0xffffffff
push 4
pop eax
test eax, eax
je 0x10044fb3
cmp dword [ebp - 8], 0
je 0x10044fb3
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10044fb3
mov dword [ebp - 0x14], 1
jmp 0x10044fb7
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 8]
add eax, dword [ebp - 8]
sub eax, dword [ebp - 8]
cmp dword [ebp - 8], eax
jge 0x10044fd8
mov dword [ebp - 0x1c], 1
jmp 0x10044fdc
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10044fff
push 0
push 0x1dd6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x1004506a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0xffffffe5
jmp 0x10045047
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x1e
jne 0x1004506a
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
push 0
mov ecx, dword [ebp - 0x38]
call fcn.10016fb3
mov ecx, dword [ebp - 0x3c]
mov eax, dword [eax]
mov dword [ecx], eax
jmp 0x1004503c
mov esp, ebp
pop ebp
ret
Function at 0x10048414
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10048454
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 0xf
push 5
call fcn.10044ccf
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov dword [ecx + 4], eax
jmp 0x10048461
push 0x511
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esp, ebp
pop ebp
ret

Function at 0x100486b2
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1004870d
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100486ee
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x1004870b
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x14]
call fcn.10016fb3
mov dword [eax], 0x648
jmp 0x100486e3
jmp 0x10048721
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10048721
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret

Function at 0x10048d39
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10048d72
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 2
mov ecx, dword [ebp - 0xc]
call fcn.10016fb3
mov ecx, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ecx], eax
jmp 0x10048d90
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10048d90
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esp, ebp
pop ebp
ret
Function at 0x1007bc32
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008538c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006b5bc
mov dword [ebp - 0x14], eax
cmp dword [0x11182134], esi
jne 0x1007bd25
push 0x800
push esi
push 0x10007f58
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1007bcb2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1007be05
push esi
push esi
push 0x10007f58
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1007be05
push 0x10007f70
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007be05
push eax
call ebx
push 0x10007f7c
push edi
mov dword [0x11182134], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007f8c
push edi
mov dword [0x11182138], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007fa0
push edi
mov dword [0x1118213c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x11182144], eax
test eax, eax
je 0x1007bd22
push 0x10007fbc
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x11182140], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007bd4a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1007bd3d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1007bd5f
push 4
pop eax
jmp 0x1007be07
cmp dword [ebp - 0x14], esi
je 0x1007bd5f
push dword [0x11182134]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1007bd44
mov eax, dword [0x11182140]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1007bdbd
cmp dword [0x11182144], edi
je 0x1007bdbd
push eax
call ebx
push dword [0x11182144]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1007bdbd
test eax, eax
je 0x1007bdbd
call ecx
test eax, eax
je 0x1007bdb2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1007bdb2
test byte [ebp - 8], 1
jne 0x1007bdbd
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1007bded
mov eax, dword [0x11182138]
cmp eax, edi
je 0x1007bdea
push eax
call ebx
test eax, eax
je 0x1007bdea
call eax
mov esi, eax
test esi, esi
je 0x1007bdea
mov eax, dword [0x1118213c]
cmp eax, edi
je 0x1007bdea
push eax
call ebx
test eax, eax
je 0x1007bdea
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x11182134]
call ebx
test eax, eax
je 0x1007be05
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007be07
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x40380b
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x403834
cmp al, 0x22
je 0x40382c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x403820
cmp byte [esi], 0x22
jne 0x40383e
inc esi
jmp 0x40383e
cmp al, 0x20
jle 0x40383e
inc esi
cmp byte [esi], 0x20
jg 0x403838
mov al, byte [esi]
test al, al
je 0x403848
cmp al, 0x20
jle 0x403831
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
call fcn.004038b6
push 0x405004
push section..data
call fcn.0040389c
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x403878
movzx eax, word [ebp - 0x14]
jmp 0x40387b
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.004038ce
push esi
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x605544ff
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x4310d2
nop
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2ccd1d85
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219