joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004282
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebp + 8], 0
je 0x1004422
cmp dword [ebp + 0xc], 0
je 0x1004422
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1004422
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10042aa
sub eax, edx
push ebx
mov ecx, eax
mov eax, dword [ebp + 0xc]
push esi
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10042bd
sub eax, esi
lea eax, [eax + ecx + 5]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x10042e9
push 0x6c
call fcn.01004e8d
pop ecx
or esi, 0xffffffff
jmp 0x100441c
mov eax, dword [ebp + 0xc]
push edi
mov esi, 0x1001344
mov edi, ebx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10042f9
mov edi, ebx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1004305
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100431e
mov eax, dword [ebp + 0x10]
mov esi, 0x1001340
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004332
mov edi, ebx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100433e
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x3a
push ebx
rep movsb byte es:[edi], byte [esi]
call fcn.0100fbb0
xor edi, edi
cmp eax, edi
pop ecx
pop ecx
jne 0x1004377
push 0x8e
call fcn.01004e8d
pop ecx
or esi, 0xffffffff
jmp 0x1004414
mov byte [eax], 0x5c
inc eax
cmp byte [eax], 0x5c
jne 0x10043b7
and byte [eax], 0
push 0x3a
push dword [ebp + 0x10]
call fcn.0100fbb0
inc eax
pop ecx
inc eax
pop ecx
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004393
mov edi, ebx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100439f
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor edi, edi
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10043bc
sub eax, edx
cmp byte [eax + ebx - 1], 0x5c
jne 0x10043de
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10043d1
sub eax, edx
and byte [eax + ebx - 1], cl
mov eax, dword [ebp + 8]
push edi
push edi
mov dword [ebp - 0x10], eax
push edi
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call sub.MPR.dll_WNetAddConnection2A
mov esi, eax
cmp esi, edi
je 0x1004414
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
jmp 0x1004436
push 0x1001330
push 0x8f
call fcn.01004e8d
pop ecx
pop ecx
or eax, 0xffffffff
leave
ret 0xc
Function at 0x1004c29
Capabilities:
Persist via path registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push edi
push 0x3d
push dword [ebp + 8]
call fcn.0100fbb0
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x1004c55
push 0x10013fc
call fcn.0100fb65
pop ecx
jmp 0x1004d5a
push ebx
push esi
inc edi
mov esi, edi
sub esi, dword [ebp + 8]
lea eax, [esi + 1]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x1004c7c
push 0x6c
call fcn.01004e8d
pop ecx
jmp 0x1004d58
dec esi
push esi
push dword [ebp + 8]
push ebx
call fcn.0100fec0
push 0x1001390
push ebx
call sub.ntdll.dll__strcmpi
add esp, 0x14
test eax, eax
jne 0x1004ca5
lea eax, [ebp - 4]
push eax
push dword [0x101d304]
jmp 0x1004cdd
push 0x1001388
push ebx
call sub.ntdll.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x1004cc2
lea eax, [ebp - 4]
push eax
push dword [0x101d308]
jmp 0x1004cdd
push 0x100137c
push ebx
call sub.ntdll.dll__strcmpi
test eax, eax
pop ecx
pop ecx
jne 0x1004ce6
lea eax, [ebp - 4]
push eax
push dword [0x101d30c]
push edi
call fcn.01004b3a
mov edi, dword [ebp - 4]
xor eax, eax
cmp edi, eax
je 0x1004d58
push eax
lea ecx, [ebp - 8]
push ecx
push eax
push 0x20006
push 1
push eax
push eax
push 0x10013d0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jl 0x1004d30
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1004d14
sub eax, ecx
inc eax
push eax
push edi
push 1
push 0
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x1004d3b
push 0x1001398
call fcn.0100fb65
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
call esi
cmp dword [ebp - 4], 0
je 0x1004d4f
push dword [ebp - 4]
call esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop edi
leave
ret 4

Function at 0x1004d5f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [ebp + 8]
mov cl, al
add cl, 0x40
dec al
mov dword [ebp - 0xc], 0x3a413d
mov byte [ebp - 0xb], cl
lea ecx, [ebp - 0x80c]
push ecx
push eax
call fcn.0100b772
test eax, eax
jne 0x1004df5
push ebx
xor ebx, ebx
push ebx
lea eax, [ebp + 8]
push eax
push ebx
push 0x20006
push 1
push ebx
push ebx
push 0x10013d0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jl 0x1004de0
lea eax, [ebp - 0x80c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1004dbc
sub eax, edx
inc eax
push eax
lea eax, [ebp - 0x80c]
push eax
push 1
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x1004deb
push 0x100142c
call fcn.0100fb65
pop ecx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4
Function at 0x1009602
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 0x1001e9c
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call fcn.01005b40
test eax, eax
jne 0x1009631
mov eax, dword [ebp - 4]
cmp eax, 2
ja 0x1009638
xor eax, eax
jmp 0x10096ec
add eax, 2
push esi
push eax
call fcn.0101014d
mov esi, eax
cmp esi, ebx
pop ecx
jne 0x1009658
push 0x6c
call fcn.01004e8d
pop ecx
xor eax, eax
jmp 0x10096eb
mov ecx, dword [ebp - 4]
add ecx, 2
push edi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100968b
xor edi, edi
jmp 0x1009697
push esi
call fcn.01006207
xor edi, edi
test eax, eax
je 0x100969a
inc edi
jmp 0x10096c9
xor ecx, ecx
xor eax, eax
cmp dword [ebp - 4], ebx
jbe 0x10096c9
cmp byte [ecx + esi], 0xd
jne 0x10096b1
cmp byte [ecx + esi + 1], 0xa
jne 0x10096b1
inc ecx
mov dl, byte [ecx + esi]
mov byte [eax + esi], dl
inc ecx
inc eax
cmp ecx, dword [ebp - 4]
jb 0x10096a3
jmp 0x10096c4
mov byte [eax + esi], bl
inc eax
cmp eax, dword [ebp - 4]
jb 0x10096c0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
jne 0x10096dc
push esi
call fcn.010094d3
push esi
call fcn.0100fdeb
xor eax, eax
cmp edi, ebx
pop ecx
sete al
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x100c864
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov al, byte [ebp + 8]
add al, 0x41
mov dword [ebp - 0xc], 0x5c3a41
mov byte [ebp - 0xc], al
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
jne 0x100c893
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x1000
jmp 0x100c8a3
cmp eax, 1
jne 0x100c89d
push 0xf
pop eax
jmp 0x100c8a5
mov eax, dword [ebp + 0xc]
and dword [eax], 0
xor eax, eax
leave
ret 8
Function at 0x100ca35
Capabilities:
Get disk information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor eax, eax
push esi
push edi
xor ebx, ebx
mov byte [ebp - 4], bl
lea edi, [ebp - 3]
stosw word es:[edi], ax
mov eax, dword [0x7ffe02d0]
shr eax, 8
not al
test al, 1
je 0x100cac8
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
push 0x1002060
push 0x80000002
call dword [entry0]
test eax, eax
jne 0x100ca9e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 0x100204c
push dword [ebp - 0xc]
mov dword [ebp - 8], 3
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsx eax, byte [ebp - 4]
push eax
call fcn.01010a76
test eax, eax
pop ecx
jne 0x100cab1
mov byte [ebp - 4], 0x43
movsx eax, byte [ebp - 4]
push eax
mov dword [ebp - 0x18], 0x5c3a41
call fcn.010108e3
pop ecx
sub eax, 0x41
jmp 0x100cad2
push 2
mov dword [ebp - 0x18], 0x5c3a41
pop eax
cmp eax, 0x1a
mov dword [ebp - 8], eax
mov ebx, eax
jge 0x100cb09
mov al, bl
add al, 0x41
mov byte [ebp - 0x18], al
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov esi, eax
cmp esi, 4
jne 0x100cafe
push ebx
call fcn.0100c9a9
test eax, eax
jne 0x100cb13
cmp esi, 1
je 0x100cb13
inc ebx
cmp ebx, 0x1a
jl 0x100cadc
push 0xf
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, dword [ebp + 8]
inc ebx
mov word [eax], bx
xor eax, eax
jmp 0x100cb0c

Function at 0x100cb1e
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov al, byte [ebp + 8]
add al, 0x41
mov dword [ebp - 0xc], 0x5c3a41
mov byte [ebp - 0xc], al
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
jne 0x100cb5d
movzx eax, word [ebp + 8]
push eax
mov esi, 0x2000
call fcn.0100c9a9
test eax, eax
je 0x100cb6d
mov esi, 0xa000
jmp 0x100cb6d
dec eax
neg eax
sbb eax, eax
mov ecx, 0x800
and eax, ecx
add eax, ecx
mov esi, eax
mov ax, si
pop esi
leave
ret 4
Function at 0x100e85b
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x100e92a
cmp dword [ebp + 0x14], ebx
je 0x100e92a
cmp byte [ebp + 0xc], bl
je 0x100e92a
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100e884
sub eax, edx
push esi
mov esi, eax
mov eax, dword [ebp + 0x14]
push edi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100e897
sub eax, edi
lea eax, [eax + esi + 5]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
jne 0x100e8c0
push 0x6c
call fcn.01004e8d
pop ecx
or edi, 0xffffffff
jmp 0x100e924
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x1002220
push esi
call fcn.010106a3
movzx eax, byte [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push 0x1002254
push eax
call fcn.010106a3
add esp, 0x1c
push ebx
lea eax, [ebp - 0xc]
push ebx
mov dword [ebp - 0x1c], eax
push ebx
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call sub.MPR.dll_WNetAddConnection2A
mov edi, eax
cmp edi, ebx
je 0x100e91d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
jmp 0x100e93e
push 0x10020d4
push 0x8f
call fcn.01004e8d
pop ecx
pop ecx
or eax, 0xffffffff
pop ebx
leave
ret 0x10
Function at 0x101147b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push esi
push edi
je 0x10114e3
push ebx
call fcn.01011444
test eax, eax
pop ecx
jne 0x10114b4
mov dword [0x101d770], 0xf
mov dword [0x101d76c], 0xd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
and byte [ebp + 0xb], 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x108]
push eax
mov esi, 0x104
push esi
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x10114f6
lea eax, [ebp - 0x108]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x10114ad
inc eax
cmp eax, esi
ja 0x10114ad
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x1011527
cmp eax, dword [ebp + 0x10]
jg 0x101150e
mov eax, dword [ebp + 0x10]
push eax
call fcn.0101014d
mov edi, eax
test edi, edi
pop ecx
jne 0x101153b
mov dword [0x101d76c], 0xc
jmp 0x10114ad
cmp eax, dword [ebp + 0x10]
jle 0x101153b
mov dword [0x101d76c], 0x22
jmp 0x10114ad
mov esi, edi
lea eax, [ebp - 0x108]
lea ecx, [ebp - 0x108]
sub esi, eax
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x101154b
mov eax, edi
jmp 0x10114af
Function at 0x10117cd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
xor eax, eax
cmp edx, dword [eax*8 + 0x101cce8]
je 0x10117ed
inc eax
cmp eax, 0x12
jb 0x10117de
shl eax, 3
cmp edx, dword [eax + 0x101cce8]
mov dword [ebp + 8], eax
jne 0x101198b
mov ecx, dword [0x101d75c]
cmp ecx, 1
je 0x1011960
test ecx, ecx
jne 0x101181f
cmp dword [0x101c8c0], 1
je 0x1011960
cmp edx, 0xfc
je 0x101198b
and byte [ebp - 8], 0
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x101185a
push 5
pop ecx
mov esi, 0x1002f94
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10c]
lea ebx, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1011869
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x10118a1
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1011881
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x1002f90
push ebx
call fcn.0100fec0
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10118a6
sub eax, edx
mov ecx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x101ccec]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10118bd
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.010105e0
mov edx, esp
push 6
pop ecx
mov esi, 0x1002f74
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10118e9
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10118f5
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x101190e
mov eax, dword [ebp + 8]
mov esi, 0x1002f70
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 0x101ccec]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1011929
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1011935
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x1002f48
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.01017902
add esp, 0xc
jmp 0x101198b
mov ecx, dword [eax + 0x101ccec]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x101196b
push 0
lea edx, [ebp - 4]
push edx
sub eax, esi
push eax
push ecx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1014c75
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.010105e0
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1014d0a
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x101d778]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x1014d0a
cmp eax, 1
je 0x1014d22
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1014d0a
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x1014cdf
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x1014d06
xor eax, eax
inc eax
jmp 0x1014d3e
cmp esi, ebx
jae 0x1014d0e
xor eax, eax
jmp 0x1014d3e
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x101d778]
jmp 0x1014d24
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1015f3e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x101f268]
push edi
jae 0x1016105
mov eax, esi
sar eax, 5
lea ebx, [eax*4 + 0x101f280]
mov eax, dword [ebx]
and esi, 0x1f
shl esi, 3
add eax, esi
mov dl, byte [eax + 4]
test dl, 1
je 0x1016105
and dword [ebp - 0xc], 0
cmp dword [ebp + 0x10], 0
mov edi, dword [ebp + 0xc]
mov ecx, edi
je 0x1015fe4
test dl, 2
jne 0x1015fe4
test dl, 0x48
je 0x1015fae
mov al, byte [eax + 5]
cmp al, 0xa
je 0x1015fae
dec dword [ebp + 0x10]
mov byte [edi], al
mov eax, dword [ebx]
lea ecx, [edi + 1]
mov dword [ebp - 0xc], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
mov eax, dword [ebx]
push ecx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1015ff7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
cmp eax, ecx
jne 0x1015fdf
mov dword [0x101d770], ecx
jmp 0x101610c
cmp eax, 0x6d
jne 0x1015feb
xor eax, eax
jmp 0x1016119
push eax
call fcn.01014c16
pop ecx
jmp 0x1016116
mov eax, dword [ebx]
mov edx, dword [ebp - 0x10]
add dword [ebp - 0xc], edx
lea ecx, [eax + esi + 4]
mov al, byte [ecx]
test al, al
jns 0x1016100
test edx, edx
je 0x101601a
cmp byte [edi], 0xa
jne 0x101601a
or al, 4
jmp 0x101601c
and al, 0xfb
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, eax
cmp eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jae 0x10160fa
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x1a
je 0x10160ea
cmp al, 0xd
je 0x1016050
mov byte [edi], al
inc edi
inc dword [ebp - 8]
jmp 0x10160dc
dec ecx
cmp dword [ebp - 8], ecx
jae 0x101606a
mov eax, dword [ebp - 8]
inc eax
cmp byte [eax], 0xa
jne 0x1016065
add dword [ebp - 8], 2
jmp 0x10160be
mov dword [ebp - 8], eax
jmp 0x10160d8
inc dword [ebp - 8]
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1016092
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10160d8
cmp dword [ebp - 0x10], 0
je 0x10160d8
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x48
je 0x10160b3
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x10160be
mov byte [edi], 0xd
mov ecx, dword [ebx]
mov byte [ecx + esi + 5], al
jmp 0x10160db
cmp edi, dword [ebp + 0xc]
jne 0x10160c3
cmp byte [ebp - 1], 0xa
jne 0x10160c3
mov byte [edi], 0xa
jmp 0x10160db
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0101743b
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x10160dc
mov byte [edi], 0xd
inc edi
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 8], ecx
jb 0x1016034
jmp 0x10160fa
mov eax, dword [ebx]
lea esi, [eax + esi + 4]
mov al, byte [esi]
test al, 0x40
jne 0x10160fa
or al, 2
mov byte [esi], al
sub edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], edi
mov eax, dword [ebp - 0xc]
jmp 0x1016119
and dword [0x101d770], 0
mov dword [0x101d76c], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1016526
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
push edi
mov dword [ebp - 0xc], ebx
je 0x101658e
push 0x3d
push esi
call fcn.01018c96
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 8], eax
je 0x101658e
cmp esi, eax
je 0x101658e
xor ecx, ecx
cmp byte [eax + 1], cl
mov eax, dword [0x101d798]
sete cl
cmp eax, dword [0x101d79c]
mov dword [ebp - 4], ecx
jne 0x1016574
mov edi, eax
call fcn.010164c5
mov dword [0x101d798], eax
cmp eax, ebx
jne 0x10165cd
cmp dword [ebp + 0xc], ebx
je 0x1016596
cmp dword [0x101d7a0], ebx
je 0x1016596
call fcn.01016e67
test eax, eax
je 0x10165cd
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
jne 0x10166d7
push 4
call fcn.0101014d
cmp eax, ebx
pop ecx
mov dword [0x101d798], eax
je 0x101658e
mov dword [eax], ebx
cmp dword [0x101d7a0], ebx
jne 0x10165cd
push 4
call fcn.0101014d
cmp eax, ebx
pop ecx
mov dword [0x101d7a0], eax
je 0x101658e
mov dword [eax], ebx
mov edi, dword [ebp - 8]
mov ebx, dword [0x101d798]
sub edi, esi
push esi
call fcn.01016478
mov edi, eax
test edi, edi
pop ecx
jl 0x1016629
cmp dword [ebx], 0
je 0x1016629
lea esi, [ebx + edi*4]
push dword [esi]
call fcn.0100fdeb
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x101660e
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov esi, eax
jmp 0x101665f
mov ecx, dword [esi + 4]
mov dword [esi], ecx
inc edi
add esi, 4
cmp dword [esi], eax
jne 0x1016605
mov eax, edi
shl eax, 2
push eax
push ebx
call fcn.01018a93
test eax, eax
mov esi, dword [ebp + 8]
pop ecx
pop ecx
je 0x101665f
jmp 0x101665a
cmp dword [ebp - 4], 0
jne 0x10166d0
test edi, edi
jge 0x1016639
neg edi
lea eax, [edi*4 + 8]
push eax
push ebx
call fcn.01018a93
test eax, eax
pop ecx
pop ecx
je 0x101658e
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov dword [0x101d798], eax
cmp dword [ebp + 0xc], 0
je 0x10166bb
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101666a
sub eax, edx
add eax, 2
push eax
call fcn.0101014d
mov edi, eax
test edi, edi
pop ecx
je 0x10166bb
mov ecx, esi
sub eax, esi
mov dl, byte [ecx]
mov byte [eax + ecx], dl
inc ecx
test dl, dl
jne 0x1016687
mov ecx, dword [ebp - 8]
add eax, ecx
and byte [eax], dl
mov ecx, dword [ebp - 4]
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x10166b4
or dword [ebp - 0xc], 0xffffffff
push edi
call fcn.0100fdeb
pop ecx
cmp dword [ebp - 4], 0
je 0x10166c8
push esi
call fcn.0100fdeb
pop ecx
mov eax, dword [ebp - 0xc]
jmp 0x1016591
push esi
call fcn.0100fdeb
pop ecx
xor eax, eax
jmp 0x1016591

Function at 0x10172b2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10172d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01014c16
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x10172f3
test byte [esp + 8], 2
je 0x10172f3
mov dword [0x101d76c], 0xd
mov dword [0x101d770], 5
jmp 0x10172ce
xor eax, eax
ret