joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009e0d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100aa4e5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100be008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.1009e880
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1009e15a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x1009e2a0
cmp dword [ebx + 8], 0xfffffff
jne 0x1009e16e
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.1009f6b6
mov ecx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
mov byte [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100b39d0]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100b39d0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1009e253
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.100a0980
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x1009e235
cmp eax, 0x200
jae 0x1009e233
shl eax, 3
cmp eax, ecx
jae 0x1009e235
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10070800
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1009e880
mov edx, dword [eax]
jmp 0x1009e256
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x1009e281
mov dword [ecx + eax*8], esi
jmp 0x1009e293
cmp ebx, edx
jne 0x1009e28a
mov dword [ecx + eax*8], esi
jmp 0x1009e297
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1009e297
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1009e8f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100aa4e5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100be008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.1009e880
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1009e97a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x1009eac2
cmp dword [ebx + 8], 0xfffffff
jne 0x1009e98e
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.1009f6b6
mov edx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100b39d0]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100b39d0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1009ea75
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.100a0980
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x1009ea57
cmp eax, 0x200
jae 0x1009ea55
shl eax, 3
cmp eax, ecx
jae 0x1009ea57
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10070800
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1009e880
mov edx, dword [eax]
jmp 0x1009ea78
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x1009eaa3
mov dword [ecx + eax*8], esi
jmp 0x1009eab5
cmp ebx, edx
jne 0x1009eaac
mov dword [ecx + eax*8], esi
jmp 0x1009eab9
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1009eab9
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x8f3076
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x74], ah
pushal
je 0x8f3006
jne 0x8f3006
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
pushal
je 0x8f3006
jne 0x8f3006
ljmp 0x7601:0x7503744b
dec ebx
je 0x8f300c
jne 0x8f300c
jbe 0x8f3053
inc esi
jo 0x8f3010
dec edi
inc eax
jmp 0x8f3014
js 0x8f301b
inc eax
push eax
call 0x8f3022
jl 0x8f2fa6
les eax, [eax + ebx*2]
mov si, 0x9eb7
call 0x8f3030
jns 0x8f2fb4
les eax, [edi + ecx]
mov eax, dword [ecx]
add byte [eax], al
add byte [eax + 0x50], al
call 0x8f3041
jle 0x8f2fc5
les eax, [eax + ebx*2]
mov si, ax
call 0x8f304e
jp 0x8f2fd2
les eax, [esi]
or esi, edx
call 0x8f305a
bnd call 0x8f305a
jnp 0x8f2fde
les eax, [edi + ecx]
add byte [ebx], 0
add byte [eax], al
rcl si, cl
je 0x8f306b
jne 0x8f306b
jmp 0xfa66b1d5
adc di, 0x91f9
call 0x8f3076
jmp 0x8f2ffa
Function at 0x8f30ab
Capabilities:
Packed with generic packer

Disassembly:
jge 0x8f3083
jb 0x8f30d2
dec esi
jmp 0x8f3087
adc ax, cx
js 0x8f308f
jns 0x8f308f
jle fcn.008f309f
jno 0x8f3098
add dword [ebx], 0x66000000
add edi, ebx
add di, bx
push eax
call fcn.008f309f
jle 0x8f3023
invalid
add esp, 4
pop eax
les eax, [eax + ebx*2]
sar edi, cl
call 0x8f30ab
jns 0x8f302f
les eax, [ebx + ecx*4]
clc
jmp 0x8f30b3
jge 0x8f30bc
sbb si, di
popal
push ecx
pop dword [0x8f3c41]
pushal
call 0x8f30cb
jp 0x8f304f
les eax, [eax + edi*8]
mov esi, 0x8f31b4
pop dword [eax]
push eax
call 0x8f30db
call 0x5893f562
inc edi
jb 0x8f30e8
test edx, ebx
mov eax, 0x97a2e34d
or ebx, edi
sub eax, 0x61804a22
push eax
call 0x8f30fc
jbe 0x8f3080
les eax, [eax + ebx*2]
pop eax
stc
mov ecx, 0xa15d6edf
sar dx, 0x66
xor ecx, 0xa15d6ee1
jp 0x8f3115
jnp 0x8f3115
jnp 0x8f30ff
jmp 0x8f311e
add al, 0
add byte [eax], al
jbe 0x8f311e
add byte [esi + 2], dh
test edi, edx
mov ebp, dword [esi]
jmp 0x8f3123
sar ebx, cl
ror edx, 0x3a
xor ebp, eax
jl 0x8f312f
jge 0x8f312f
jmp 0x8f3119
jmp 0x8f313a
mov di, dx
js 0x8f313a
clc
rol ebp, 0x12
jmp 0x8f3140
rcr edi, cl
sub ebp, dword [esi + 4]
js 0x8f314a
jns 0x8f314a
jle 0x8f3134
jmp 0x8f3151
add al, byte [eax]
add byte [eax], al
xchg edi, edx
mov dword [esi], ebp
call 0x8f3159
jmp 0x6b335e0
Function at 0x1000e943
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000e982
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000e982
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000e982
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000e982
cmp dword [ecx + 0x74], 0xe
jbe 0x1000e982
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100115ff
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001169c
push ebx
push esi
call fcn.100115c8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001155c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10011649
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001169b
push edi
push eax
call fcn.100125ba
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10011669
call fcn.100100a4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001169a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001155c
add esp, 0x20
test eax, eax
jne 0x10011688
push edi
call fcn.100100a4
jmp 0x10011690
push ebx
call fcn.100100a4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10011909
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10019888
push 0x10019880
push str.FlsAlloc
push 0x1f
call fcn.10011825
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001193d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10018150]
call esi
jmp 0x10011943
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10011987
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10019898
push 0x10019890
push str.FlsGetValue
push 0x21
call fcn.10011825
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100119be
push dword [ebp + 8]
mov ecx, esi
call dword [0x10018150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100119c6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100198a0
push 0x10019898
push str.FlsSetValue
push 0x22
call fcn.10011825
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10011a00
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10018150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10017080
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100170ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100170ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1001203
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
xor ebx, ebx
inc ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 4
lea eax, [ebp - 0x14]
push eax
push 0x22
push 0xffffffffffffffff
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ntdll.dll_NtSetInformationProcess]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
mov eax, dword [ebp + 8]
inc esi
mov dword [0x100504c], eax
lea eax, [esi + esi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x10], eax
cmp eax, edi
je 0x1001355
push dword [ebp + 0x10]
push esi
push eax
call fcn.01001ae1
test eax, eax
jl 0x100134c
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
call fcn.01001622
test eax, eax
je 0x100134c
test byte [ebp - 0x18], bl
jne 0x10024d2
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov dword [ebp - 0xc], edi
call fcn.01001e56
push eax
mov dword [ebp - 0x24], eax
call fcn.010019e3
test eax, eax
je 0x10024b5
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 8], edi
push dword [ebp - 0x1c]
mov dword [ebp - 4], edi
push dword [ebp + 8]
push dword [0x100504c]
call fcn.01001b87
mov ebx, dword [ebp - 8]
test eax, eax
je 0x100133a
cmp ebx, edi
jne 0x10021db
push dword [ebp - 4]
call fcn.01001467
push 0x1001360
push dword [0x100504c]
call fcn.010013b9
push dword [ebp + 0x14]
mov esi, eax
push dword [ebp + 0x10]
push dword [0x100504c]
push esi
push dword [ebp - 0x20]
call fcn.01001444
cmp esi, edi
je 0x1001331
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0xc]
push dword [ebp - 0x24]
call fcn.0100138b
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp + 0x10], ebx
jmp 0x10012f7
push 0x10024e4
push dword [ebp + 8]
push 0x403
push dword [0x100504c]
call fcn.0100389e
jmp 0x1001341
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.01003955
jmp 0x100134c
Function at 0x1001467
Capabilities:
Access pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x18]
push esi
push dword [ebp + 8]
mov esi, dword [eax + 0x30]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
cmp word [eax + 0x14], 0
je 0x1001491
cmp dword [eax + 0x4c], 0
jne 0x10023b3
lea eax, [ebp - 4]
push eax
push 0xa
push 1
push dword [esi + 8]
call dword [sym.imp.imagehlp.dll_ImageDirectoryEntryToData]
test eax, eax
je 0x10014b3
movzx eax, word [eax + 0x34]
test ax, ax
jne 0x10023f0
pop esi
leave
ret 4
movzx ecx, byte [eax + 0x4c]
mov dword [esi + 0xa4], ecx
movzx ecx, byte [eax + 0x4d]
mov dword [esi + 0xa8], ecx
mov cx, word [eax + 0x4e]
mov edx, 0x3fff
and cx, dx
mov word [esi + 0xac], cx
mov eax, dword [eax + 0x4c]
xor eax, 0xbfffffff
shr eax, 0x1e
mov dword [esi + 0xb0], eax
jmp 0x1001491
mov word [esi + 0xae], ax
jmp 0x10014b3

Function at 0x10014bd
Capabilities:
Access pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1005040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 8
xor ebx, ebx
push ebx
push esi
mov dword [ebp - 0x210], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x214], eax
cmp eax, ebx
je 0x10023fc
push eax
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
cmp eax, ebx
je 0x1001519
mov ecx, 0x100
test word [eax + 0x5e], cx
je 0x1001519
push 3
call dword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001189
leave
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0xc1
cmp eax, edi
jne 0x100243f
push esi
call fcn.010039e5
test eax, eax
je 0x100241c
xor eax, eax
jmp 0x100151f
lea eax, [ebp - 0x218]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
push ebx
mov dword [ebp - 0x218], esi
push 0x3000
jmp 0x1002454
push ebx
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push ebx
push eax
push ebx
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
cmp eax, ebx
je 0x1001519
lea eax, [ebp - 0x20c]
push eax
push esi
push 0x401
push dword [ebp - 0x210]
call fcn.0100389e
jmp 0x1001519
Function at 0x1001e56
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x1005040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x210], eax
mov dword [eax], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, 0x104
cmp eax, 0xffffffff
je 0x100233b
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01001ae1
test eax, eax
jl 0x100235b
and dword [ebp - 0x22c], 0
lea eax, [ebp - 0x20c]
push eax
or ebx, 0xffffffff
mov dword [ebp - 0x230], 0x20
mov dword [ebp - 0x228], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x1001fe8
mov edi, eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01002001
mov esi, dword [sym.imp.KERNEL32.dll_CreateActCtxW]
test eax, eax
jl 0x1001f03
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, ebx
jne 0x1002618
xor eax, eax
mov word [ebp + edi*2 - 0x20c], ax
cmp ebx, 0xffffffff
jne 0x10020fc
lea eax, [ebp - 0x230]
push eax
mov dword [ebp - 0x22c], 8
mov dword [ebp - 0x21c], 0x7b
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10020fc
lea eax, [ebp - 0x230]
push eax
mov dword [ebp - 0x21c], 0x7c
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1001fd3
lea eax, [ebp - 0x230]
push eax
mov dword [ebp - 0x21c], 2
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10020fc
cmp dword [ebp + 0x10], 0
je 0x1001fd3
and dword [ebp - 0x254], 0
push 7
pop edx
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x250]
rep stosd dword es:[edi], eax
push eax
mov dword [ebp - 0x250], 0x88
mov dword [ebp - 0x240], edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x254]
push eax
mov dword [ebp - 0x254], 0x20
call esi
cmp eax, ebx
je 0x1001fd3
push dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001189
leave
ret 0xc
push dword [ebp - 0x210]
push ebx
jmp 0x1001fcd
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x1001ea9
xor eax, eax
jmp 0x1001fd5
lea eax, [ebp - 0x230]
push eax
call esi
mov ebx, eax
jmp 0x1001f03
Function at 0x10029b3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x1005040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push eax
mov dword [ebp - 0x48], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1002a4f
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea eax, [ebp - 0x4c]
push eax
push 0x40
lea eax, [ebp - 0x44]
push eax
push ebx
call edi
test eax, eax
je 0x1002a47
mov eax, 0x5a4d
cmp ax, word [ebp - 0x44]
jne 0x1002a47
push esi
push esi
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1002a47
push esi
lea eax, [ebp - 0x4c]
push eax
push 0xf8
lea eax, [ebp - 0x144]
push eax
push ebx
call edi
test eax, eax
je 0x1002a47
movzx eax, word [ebp - 0x140]
mov dword [ebp - 0x48], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x48]
pop esi
xor ecx, ebp
pop ebx
call fcn.01001189
leave
ret 4
Function at 0x10039e5
Capabilities:
Accept command line arguments
Create process on windows
Get common file path
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x1005040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push eax
mov dword [ebp - 0x214], ebx
call fcn.010029b3
mov esi, eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x1003b45
cmp dword [ebp - 0x214], ebx
je 0x1003b45
push 8
pop ecx
xor eax, eax
mov dword [ebp - 0x248], ebx
lea edi, [ebp - 0x244]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 9
pop eax
cmp ax, word [ebp - 0x248]
jne 0x1003a70
cmp esi, 0x8664
jne 0x1003b45
push 6
pop eax
cmp ax, word [ebp - 0x248]
jne 0x1003a88
cmp esi, 0x200
jne 0x1003b45
push 0xf6
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1003b45
push ebx
push 0x1003b58
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.0100384e
test eax, eax
jl 0x1003b45
mov esi, dword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
push ebx
call esi
push 0x40
lea eax, [ebp - 0x264]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x268]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0x268], 0x44
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1003b45
push 1
call esi
push 0xffffffffffffffff
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x224]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
call esi
push dword [ebp - 0x220]
call esi
cmp edi, ebx
jne 0x1003b45
xor eax, eax
inc eax
jmp 0x1003b47
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001189
leave
ret 4
Function at 0x40b314
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor ebx, ebx
push eax
mov edi, 0x4dd200
push ebx
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, 0x2b4
lea eax, [ebp - 0x2bc]
push esi
push ebx
push eax
call fcn.00476d80
lea eax, [ebp - 8]
add esp, 0xc
neg eax
sbb eax, eax
lea ecx, [ebp - 4]
and eax, ecx
xor ecx, ecx
cmp dword [ebp + 8], ebx
mov eax, dword [eax]
sete cl
or cx, 0x4008
push ecx
lea ecx, [ebp - 0x2bc]
push esi
push ecx
push ebx
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea ecx, [ebp - 8]
mov esi, eax
neg ecx
sbb ecx, ecx
lea eax, [ebp - 4]
and ecx, eax
mov dword [ebp - 8], edi
call fcn.0040b6a2
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4