joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10037020
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x260
mov eax, dword [0x100ba4f0]
xor eax, esp
push ebx
push edi
mov edi, dword [esp + 0x26c]
mov dword [esp + 0x264], eax
mov eax, dword [edi + 0x14]
xor ebx, ebx
cmp eax, ebx
je 0x10037169
push 0x104
lea eax, [esp + 0x60]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x5c]
push 0x5c
push ecx
call fcn.10046916
add esp, 8
cmp eax, ebx
je 0x10037072
mov word [eax + 2], bx
push ebp
push 0x104
lea edx, [esp + 0x64]
push str.DebugMessage.exe
push edx
call fcn.100468d9
mov eax, dword [edi + 0x18]
add esp, 0xc
cmp eax, 0x10
mov word [esp + 0x266], bx
lea ebp, [edi + 4]
jb 0x100370a2
mov eax, dword [ebp]
jmp 0x100370a4
mov eax, ebp
push esi
push ebx
push ebx
push 0xffffffffffffffff
push eax
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
cmp esi, ebx
je 0x10037167
lea eax, [esi + esi]
push eax
call fcn.100788b6
mov ebx, eax
mov eax, dword [edi + 0x18]
add esp, 4
cmp eax, 0x10
jb 0x100370db
mov eax, dword [ebp]
jmp 0x100370dd
mov eax, ebp
push esi
push ebx
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1003715e
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
push ebx
lea eax, [esp + 0x88]
push eax
mov dword [esp + 0x48], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1003714e
mov ecx, dword [esp + 0x10]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
jmp 0x1003715e
push 0x10
push str.Fatal_error
push ebx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
call fcn.100788bb
add esp, 4
pop esi
pop ebp
mov ecx, dword [esp + 0x264]
pop edi
pop ebx
xor ecx, esp
call fcn.10043e9e
add esp, 0x260
ret

Function at 0x10037680
Capabilities:
Delete file

Disassembly:
mov eax, dword [0x100c51d4]
test eax, eax
je 0x1003769a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x100c51d4], 0
mov eax, dword [esp + 0xc]
mov dword [0x100c50c4], eax
mov eax, dword [esp + 8]
cmp eax, 1
mov dword [0x100c50c8], eax
je 0x1003770b
mov ecx, dword [esp + 4]
push 0x104
push ecx
push 0x100c50d0
call fcn.10046846
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
mov byte [0x100c51d3], 0
jne 0x100376e2
push 0x100c50d0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x100c50c4]
test eax, eax
jne 0x100376f0
jmp fcn.10037530
mov al, byte [0x100c51e0]
test al, al
jne 0x1003770b
push 0x100c50a8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [0x100c51e0], 1
ret
Function at 0x10042169
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x100421bc
call fcn.10087ae4
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x100421bc
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x100421b2
xor eax, eax
jmp 0x100422d5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x100421ec
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x100421ec
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x100422d2
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x10042219
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.1003929c
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x100422d2
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x10042262
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x10042262
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x1004225c
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.1003929c
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x100422c2
and dword [ebp + 0xc], 0
jmp 0x100422c2
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x100422c2
push 0xc
call fcn.1007888b
mov esi, eax
test esi, esi
pop ecx
je 0x100422a4
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x100422a6
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x100422bd
push dword [ebp - 8]
call fcn.100782c8
jmp 0x100422c2
call fcn.1007829f
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x10042227
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10043b50
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.10043e30
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10043beb
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x100c71ec]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x10043beb
cmp eax, 1
je 0x10043c0c
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10043beb
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x10043bb8
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x10043be7
xor eax, eax
inc eax
jmp 0x10043c2b
cmp edi, eax
jae 0x10043bef
xor eax, eax
jmp 0x10043c2b
cmp eax, esi
jae 0x10043bf6
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x100c71ec]
jmp 0x10043c0f
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10046e8b
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x10046f7b
mov eax, 0x94
call fcn.10043e30
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10046ff0
mov ecx, dword [esi + 0x10]
mov dword [0x100c71ec], ecx
mov eax, dword [esi + 4]
mov dword [0x100c71f8], eax
mov edx, dword [esi + 8]
mov dword [0x100c71fc], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x100c71f0], esi
je 0x10046ef6
or esi, 0x8000
mov dword [0x100c71f0], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x100c71f4], eax
call fcn.1004878f
test eax, eax
pop ecx
je 0x10046ff0
call fcn.1004a4b4
test eax, eax
jne 0x10046f23
call fcn.100487e0
jmp 0x10046ff0
call fcn.10050d33
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x100cb210], eax
call fcn.10050c11
mov dword [0x100c71d8], eax
call fcn.1004dc05
test eax, eax
jl 0x10046f74
call fcn.10050b6f
test eax, eax
jl 0x10046f6f
call fcn.1005093c
test eax, eax
jl 0x10046f6f
push 0
call fcn.1004758b
test eax, eax
pop ecx
jne 0x10046f6f
inc dword [0x100c71d4]
jmp 0x10047001
call fcn.1004de03
call fcn.1004a29d
jmp 0x10046f19
test eax, eax
jne 0x10046fab
cmp dword [0x100c71d4], eax
jle 0x10046ff0
dec dword [0x100c71d4]
cmp dword [0x100c7228], eax
jne 0x10046f9a
call fcn.100476c9
call fcn.1004de03
call fcn.1004a29d
call fcn.100487e0
jmp 0x10047001
cmp eax, 2
jne 0x10046ff4
push 0x8c
push 1
call fcn.1004851a
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10046ff0
push esi
push dword [0x100ba934]
call dword [0x100c73ec]
test eax, eax
push esi
je 0x10046fea
call fcn.1004a2ba
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x10047001
call fcn.10043adf
pop ecx
xor eax, eax
jmp 0x10047004
cmp eax, 3
jne 0x10047001
push 0
call fcn.1004a485
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc

Function at 0x100475f5
Capabilities:
Terminate process

Disassembly:
push 8
push 0x10099b98
call fcn.10047870
push 8
call fcn.10048744
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x100c722c], esi
jne 0x10047629
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x100c7228], esi
mov al, byte [ebp + 0x10]
mov byte [0x100c7224], al
cmp dword [ebp + 0xc], edi
jne 0x10047673
cmp dword [0x100cb208], edi
je 0x10047663
mov eax, dword [0x100cb204]
sub eax, 4
mov dword [0x100cb204], eax
cmp eax, dword [0x100cb208]
jb 0x10047663
mov eax, dword [eax]
cmp eax, edi
je 0x10047644
call eax
jmp 0x10047644
push 0x100b90bc
mov eax, 0x100b90b4
call fcn.10047573
pop ecx
push 0x100b90c8
mov eax, 0x100b90c0
call fcn.10047573
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x100476a4
cmp dword [ebp + 0x10], edi
jne 0x100476b2
mov dword [0x100c722c], esi
push dword [ebp + 8]
call fcn.10047531
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x100476b1
push 8
call fcn.1004868f
pop ecx
ret
call fcn.100478ab
ret
Function at 0x1004c75f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x1004c935
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x100c9e80]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x1004c935
test cl, 0x48
je 0x1004c7ca
cmp byte [eax + 5], 0xa
je 0x1004c7ca
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1004c81c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x1004c804
call fcn.10045163
mov dword [eax], 9
call fcn.1004516c
mov dword [eax], esi
jmp 0x1004c814
cmp eax, 0x6d
je 0x1004c935
push eax
call fcn.10045175
pop ecx
or eax, 0xffffffff
jmp 0x1004c937
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x1004c930
test eax, eax
je 0x1004c843
cmp byte [ebx], 0xa
jne 0x1004c843
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x1004c84c
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x1004c92a
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x1004c91a
cmp al, 0xd
je 0x1004c87e
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x1004c90c
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x1004c898
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x1004c893
add dword [ebp + 0x10], 2
jmp 0x1004c8ec
mov dword [ebp + 0x10], eax
jmp 0x1004c908
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1004c8c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1004c908
cmp dword [ebp - 0xc], 0
je 0x1004c908
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x1004c8e1
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x1004c8ec
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x1004c90b
cmp ebx, dword [ebp + 0xc]
jne 0x1004c8f1
cmp byte [ebp - 1], 0xa
jne 0x1004c8f1
mov byte [ebx], 0xa
jmp 0x1004c90b
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.100536bc
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1004c90c
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x1004c862
jmp 0x1004c92a
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x1004c92a
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x1004c937
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1004ea3e
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x100ba4f0]
xor ecx, ecx
xor eax, ebp
cmp dword [ebp + 0x3b4], ecx
push edi
mov edi, dword [ebp + 0x3b0]
mov dword [ebp + 0x3a0], eax
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], ecx
jne 0x1004ea7a
xor eax, eax
jmp 0x1004ebe4
mov eax, dword [ebp + 0x3ac]
push ebx
mov ebx, dword [ebp + 0x3ac]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x100c9e80]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x1004eab8
push 2
push ecx
push ecx
push dword [ebp + 0x3ac]
call fcn.100536bc
add esp, 0x10
xor ecx, ecx
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x1004eb52
cmp dword [ebp + 0x3b4], ecx
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x68], ecx
jbe 0x1004ebb5
jmp 0x1004eadc
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x64]
cmp ecx, dword [ebp + 0x3b4]
jae 0x1004eb17
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x1004eb08
inc dword [ebp - 0x78]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x6c]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 0x400
jl 0x1004eae8
mov edi, eax
lea eax, [ebp - 0x64]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1004eb76
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x1004eb7f
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x7c]
cmp eax, dword [ebp + 0x3b4]
jb 0x1004eada
jmp 0x1004eb7f
push ecx
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b4]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1004eb76
mov eax, dword [ebp - 0x80]
and dword [ebp - 0x68], 0
mov dword [ebp - 0x74], eax
jmp 0x1004eb7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x74]
test eax, eax
jne 0x1004ebdf
cmp dword [ebp - 0x68], eax
je 0x1004ebb2
push 5
pop esi
cmp dword [ebp - 0x68], esi
jne 0x1004eba7
call fcn.10045163
mov dword [eax], 9
call fcn.1004516c
mov dword [eax], esi
jmp 0x1004ebda
push dword [ebp - 0x68]
call fcn.10045175
pop ecx
jmp 0x1004ebda
mov edi, dword [ebp - 0x7c]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x1004ebc7
cmp byte [edi], 0x1a
jne 0x1004ebc7
xor eax, eax
jmp 0x1004ebe2
call fcn.10045163
mov dword [eax], 0x1c
call fcn.1004516c
and dword [eax], 0
or eax, 0xffffffff
jmp 0x1004ebe2
sub eax, dword [ebp - 0x78]
pop esi
pop ebx
mov ecx, dword [ebp + 0x3a0]
xor ecx, ebp
pop edi
call fcn.10043e9e
add ebp, 0x3a4
leave
ret
Function at 0x10050f3a
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x100ba4f0]
mov ecx, dword [ebp + 0x98]
push ebx
xor eax, ebp
push esi
mov dword [ebp + 0x8c], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x100bafd8]
je 0x10050f71
inc eax
cmp eax, 0x13
jb 0x10050f62
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x100bafd8]
jne 0x10051094
mov eax, dword [0x100c71e0]
cmp eax, 1
je 0x1005106f
cmp eax, edx
jne 0x10050fa1
cmp dword [0x100c71e4], 1
je 0x1005106f
cmp ecx, 0xfc
je 0x10051094
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edx
mov byte [ebp + 0x88], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10050fd7
lea eax, [ebp - 0x7c]
push str._program_name_unknown_
push eax
call fcn.1004b020
pop ecx
pop ecx
lea edi, [ebp - 0x7c]
mov eax, edi
push eax
call fcn.10047470
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1005100b
mov eax, edi
push eax
call fcn.10047470
mov edi, eax
lea eax, [ebp - 0x7c]
sub eax, 0x3b
push 3
add edi, eax
push 0x10099c3c
push edi
call fcn.10044d60
add esp, 0x10
push edi
call fcn.10047470
push dword [esi + 0x100bafdc]
mov ebx, eax
call fcn.10047470
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.10043e30
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.1004b020
push edi
push ebx
call fcn.1004b030
push 0x10099c38
push ebx
call fcn.1004b030
push dword [esi + 0x100bafdc]
push ebx
call fcn.1004b030
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.100514fb
add esp, 0x2c
jmp 0x10051094
push edx
lea eax, [ebp - 0x80]
push eax
lea esi, [esi + 0x100bafdc]
push dword [esi]
call fcn.10047470
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8c]
xor ecx, ebp
call fcn.10043e9e
add ebp, 0x90
leave
ret
Function at 0x100514fb
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x100c7650], ebx
push esi
push edi
jne 0x1005157b
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x100515b6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1009e5b4
push edi
call esi
test eax, eax
mov dword [0x100c7650], eax
je 0x100515b6
push 0x1009e5a4
push edi
call esi
push 0x1009e590
push edi
mov dword [0x100c7654], eax
call esi
cmp dword [0x100c71ec], 2
mov dword [0x100c7658], eax
jne 0x1005157b
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x100c7660], eax
je 0x1005157b
push 0x1009e55c
push edi
call esi
mov dword [0x100c765c], eax
mov eax, dword [0x100c765c]
test eax, eax
je 0x100515c0
call eax
test eax, eax
je 0x100515a7
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x100c7660]
test eax, eax
je 0x100515a7
test byte [ebp - 8], 1
jne 0x100515c0
cmp dword [0x100c71f8], 4
jb 0x100515ba
or byte [ebp + 0x12], 0x20
jmp 0x100515df
xor eax, eax
jmp 0x100515ef
or byte [ebp + 0x12], 4
jmp 0x100515df
mov eax, dword [0x100c7654]
test eax, eax
je 0x100515df
call eax
mov ebx, eax
test ebx, ebx
je 0x100515df
mov eax, dword [0x100c7658]
test eax, eax
je 0x100515df
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x100c7650]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10053cd3
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.10043e30
mov eax, dword [0x100ba4f0]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.1004de4f
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x10053e08
push 2
push esi
push dword [ebp + 8]
call fcn.1004de4f
add esp, 0xc
cmp eax, ebx
je 0x10053e08
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x10053da8
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.10047710
push 0x8000
push dword [ebp + 8]
call fcn.10055c12
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x10053d5e
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.1004ea3e
add esp, 0xc
cmp eax, 0xffffffff
je 0x10053d7e
sub edi, eax
test edi, edi
jg 0x10053d56
jmp 0x10053d96
call fcn.1004516c
cmp dword [eax], 5
jne 0x10053d93
call fcn.10045163
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.10055c12
pop ecx
pop ecx
jmp 0x10053df0
jge 0x10053df0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1004de4f
push dword [ebp + 8]
call fcn.1004e43f
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x10053df0
call fcn.10045163
mov dword [eax], 0xd
call fcn.1004516c
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.1004de4f
add esp, 0xc
mov eax, esi
pop edi
jmp 0x10053e0a
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10043e9e
leave
ret
Function at 0x10056378
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x1009f6b8
call fcn.10047870
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x100c76d8], edi
jne 0x100563bc
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100563a7
mov dword [0x100c76d8], ebx
jmp 0x100563bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x100563bc
mov dword [0x100c76d8], 2
mov eax, dword [0x100c76d8]
cmp eax, ebx
jne 0x100563dc
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1005649f
cmp eax, 2
je 0x100563e5
cmp eax, edi
jne 0x1005640d
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x100563f8
mov eax, dword [0x100c7620]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x10056414
xor eax, eax
jmp 0x1005649f
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.10043e30
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x10056447
cmp esi, edi
jne 0x1005645d
push dword [ebp - 0x20]
call fcn.10043acd
pop ecx
mov esi, eax
cmp esi, edi
je 0x1005640d
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x10056490
cmp dword [ebp + 0x14], edi
jne 0x1005647a
push edi
push edi
jmp 0x10056480
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x1005649c
push esi
call fcn.10043adf
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.100478ab
ret