joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10067380
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x110c
call fcn.1024a9d0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.C:cuckoo__lu.ini
lea eax, [ebp - 0x10c]
push eax
call fcn.100011d0
add esp, 0xc
push 0x2780
push 0
push 0x104f1fb8
call fcn.1024b810
add esp, 0xc
mov dword [0x104f4730], 1
mov dword [0x104f279c], 1
mov dword [0x104f2790], 0x1065e4a0
push 0x103e7694
lea ecx, [ebp - 0x10c]
push ecx
call fcn.1025d193
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100673ff
or eax, 0xffffffff
jmp 0x10067487
mov edx, dword [ebp - 8]
push edx
push 0x1000
lea eax, [ebp - 0x110c]
push eax
call fcn.1025d497
add esp, 0xc
test eax, eax
je 0x1006746c
push 0xd
lea ecx, [ebp - 0x110c]
push ecx
call fcn.1024d740
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1006743b
mov edx, dword [ebp - 4]
mov byte [edx], 0
push 0xa
lea eax, [ebp - 0x110c]
push eax
call fcn.1024d740
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1006745b
mov ecx, dword [ebp - 4]
mov byte [ecx], 0
lea edx, [ebp - 0x110c]
push edx
call fcn.100634f0
add esp, 4
jmp 0x100673ff
mov eax, dword [ebp - 8]
push eax
call fcn.1025d221
add esp, 4
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100674a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1050130c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100674d7
push 0x44
call fcn.100744c0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [0x1050130c]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10068010
Capabilities:
Delete file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [0x105019cc], eax
cmp dword [ebp + 8], 0
je 0x10068034
mov ecx, dword [ebp + 8]
push ecx
call fcn.1024f510
add esp, 4
test eax, eax
jne 0x10068039
jmp 0x100680e8
push 0x103e9494
mov edx, dword [ebp + 8]
push edx
call fcn.1025d193
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100680e8
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.1025dd92
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025dacb
add esp, 4
mov dword [ebp - 8], eax
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.1025dd92
add esp, 0xc
push 4
push 0x3000
mov eax, dword [ebp - 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100680d2
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.1025df93
add esp, 0x10
mov ecx, dword [ebp - 8]
shr ecx, 3
push ecx
push 8
mov edx, dword [ebp - 0xc]
push edx
push 0x105015dc
call fcn.10074900
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.1025d221
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esp, ebp
pop ebp
ret
Function at 0x1006f9b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x1006fa09
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1006fa09
push str.python.exe
mov eax, dword [ebp - 4]
push eax
call fcn.10079330
add esp, 8
test eax, eax
jne 0x1006f9f3
push str.pythonw.exe
mov ecx, dword [ebp - 4]
push ecx
call fcn.10079330
add esp, 8
test eax, eax
je 0x1006f9ff
mov dword [0x10506ac4], 0
jmp 0x1006fa09
mov dword [0x10506ac4], 1
mov esp, ebp
pop ebp
ret

Function at 0x10070380
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0x1065e440
call fcn.10074200
add esp, 4
push 0x1065e460
call fcn.10074200
add esp, 4
mov eax, dword [ebp + 8]
mov dword [0x1065e484], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1007d490
add esp, 4
add eax, dword [0x1065e484]
mov dword [0x1065e3e4], eax
push 0x103ea84c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x1065e488], eax
mov edx, dword [0x1065e488]
push edx
call fcn.1007d490
add esp, 4
add eax, dword [0x1065e488]
mov dword [0x1065e47c], eax
push 0x10506b20
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
call fcn.10070000
cmp dword [0x10500e54], 0
jne 0x10070410
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x10500e54], eax
xor eax, eax
pop ebp
ret

Function at 0x10073f90
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
call fcn.10076860
mov dword [ebp - 4], eax
push 0x7fff
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x7fff
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10506d70], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov dword [ebp - 8], 0
push 0x1000
call fcn.10074410
add esp, 4
push eax
lea ecx, [ebp - 0xb8]
push ecx
call fcn.10035d20
add esp, 8
push str.modules
lea edx, [ebp - 0xb8]
push edx
call fcn.100366d0
add esp, 8
lea eax, [ebp - 0xb8]
push eax
call fcn.10076da0
add esp, 4
lea ecx, [ebp - 0xb8]
push ecx
call fcn.10036830
add esp, 4
lea edx, [ebp - 0xb8]
push edx
call fcn.10036050
add esp, 4
lea eax, [ebp - 0xb8]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.10076be0
push eax
call fcn.1007b2b0
push eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0
push 1
call fcn.10034150
push eax
call fcn.10073300
add esp, 0x3c
lea ecx, [ebp - 0xb8]
push ecx
call fcn.10036120
add esp, 4
mov edx, dword [ebp - 4]
push edx
call fcn.100769a0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x10074c50
Capabilities:
Generate random numbers via rtlgenrandom
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.1024b810
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x103ebe9c
lea edx, [ebp - 0x108]
push edx
call fcn.1025e060
add esp, 8
cmp dword [0x1065dfd4], 0
jne 0x10074cb0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x1065dfd4], eax
mov ecx, dword [0x1065dfd4]
mov dword [ebp - 4], ecx
push str.NtDelayExecution
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10517548], eax
push str.NtQuerySystemInformation
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10517544], eax
push str.NtQueryInformationProcess
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10506eec], eax
push str.NtQueryInformationThread
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10506da8], eax
push str.NtQueryObject
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10506db4], eax
push str.NtQueryKey
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10506dc4], eax
push str.NtQueryAttributesFile
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10506da4], eax
push str.NtAllocateVirtualMemory
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10500eb8], eax
push str.NtProtectVirtualMemory
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10500ec0], eax
push str.NtFreeVirtualMemory
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10500eb4], eax
push str.LdrRegisterDllNotification
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10500ebc], eax
push str.SystemFunction036
push str.advapi32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10517538], eax
push str.NtMapViewOfSection
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10500ea0], eax
push str.NtUnmapViewOfSection
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10500ea4], eax
push str.RtlNtStatusToDosError
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10500eac], eax
push str.RtlGetVersion
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10500eb0], eax
mov esp, ebp
pop ebp
ret
Function at 0x10075040
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword fs:[0x30]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc]
add edx, 0xc
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0x24]
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0x2c]
sub ecx, eax
mov word [ebp - 0x20], cx
mov cx, word [ebp - 0x20]
mov word [ebp - 0x1e], cx
movzx edx, word [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x14], edx
imul eax, dword [ebp - 0x14], 1
push eax
call fcn.10074450
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100750b8
imul ecx, dword [ebp - 0x14], 1
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
call fcn.1024b810
add esp, 0xc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
movzx ecx, word [ebp - 0x20]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x28]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.1024bbe0
add esp, 0xc
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
jmp 0x100750ea
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x10]
je 0x10075144
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
movzx eax, word [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x28]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.1024c154
add esp, 0xc
test eax, eax
jne 0x10075116
jmp 0x100750e2
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
cmp edx, dword [0x1065e324]
jne 0x10075126
jmp 0x100750e2
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x20]
push ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
push ecx
call fcn.10074fe0
add esp, 8
jmp 0x100750e2
mov edx, dword [ebp - 0x1c]
push edx
call fcn.10074560
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x10075430
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xa0]
cmp eax, dword [edx + 0xc]
jne 0x1007545c
mov dword [ebp - 4], 1
jmp 0x10075463
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100765a0
Capabilities:
Get disk information
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push 0x104
mov eax, dword [ebp + 8]
push eax
push 0x10506dc8
call fcn.1025d2b0
add esp, 0xc
push 0x105172f0
call fcn.100745a0
add esp, 4
push 0x10517518
call fcn.100745a0
add esp, 4
cmp dword [0x10506dc0], 0x40
jne 0x100765f6
push str.CRITICAL:Too_many_aliases_
call fcn.1007c790
add esp, 4
push 1
call fcn.1025ae23
push str.SystemRoot_
imul ecx, dword [0x10506dc0], 0x410
mov edx, 0x208
imul eax, edx, 0
lea ecx, [ecx + eax + 0x10506ef0]
push ecx
call fcn.1025a9a0
add esp, 8
push 0x103eb700
imul edx, dword [0x10506dc0], 0x410
mov eax, 0x208
shl eax, 0
lea ecx, [edx + eax + 0x10506ef0]
push ecx
call fcn.1025a9a0
add esp, 8
mov edx, dword [0x10506dc0]
add edx, 1
mov dword [0x10506dc0], edx
mov eax, 0x41
mov word [ebp - 4], ax
jmp 0x1007666a
mov cx, word [ebp - 4]
add cx, 1
mov word [ebp - 4], cx
movzx edx, word [ebp - 4]
cmp edx, 0x5a
jg 0x1007676b
mov eax, 2
imul ecx, eax, 0
mov dx, word [ebp - 4]
mov word [ebp + ecx - 0xc], dx
mov eax, 2
shl eax, 0
mov ecx, 0x3a
mov word [ebp + eax - 0xc], cx
mov edx, 2
shl edx, 1
xor eax, eax
mov word [ebp + edx - 0xc], ax
push 0x104
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x10076766
push 0x103eb6fc
lea eax, [ebp - 0xc]
push eax
call fcn.1025d4a2
add esp, 8
push 0x103eb6f8
lea ecx, [ebp - 0x214]
push ecx
call fcn.1025d4a2
add esp, 8
cmp dword [0x10506dc0], 0x40
jne 0x10076708
push 0x103eb6dc
call fcn.1007c790
add esp, 4
push 1
call fcn.1025ae23
lea edx, [ebp - 0x214]
push edx
imul eax, dword [0x10506dc0], 0x410
mov ecx, 0x208
imul edx, ecx, 0
lea eax, [eax + edx + 0x10506ef0]
push eax
call fcn.1025a9a0
add esp, 8
lea ecx, [ebp - 0xc]
push ecx
imul edx, dword [0x10506dc0], 0x410
mov eax, 0x208
shl eax, 0
lea ecx, [edx + eax + 0x10506ef0]
push ecx
call fcn.1025a9a0
add esp, 8
mov edx, dword [0x10506dc0]
add edx, 1
mov dword [0x10506dc0], edx
jmp 0x1007665e
call fcn.10076570
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10076c50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
jmp 0x10076c75
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
je 0x10076d1a
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
cmp edx, dword [ebp + 8]
jne 0x10076d15
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x40]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x3c]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x40]
mov dword [edx + 4], ecx
push 0x48
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.1024b810
add esp, 0xc
jmp 0x10076d1a
jmp 0x10076c6d
mov esp, ebp
pop ebp
ret

Function at 0x10076d20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
jmp 0x10076d53
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0x1000
jae 0x10076d8c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
je 0x10076d8c
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
cmp edx, dword [ebp + 8]
jne 0x10076d78
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
jmp 0x10076d8e
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
jne 0x10076d8a
jmp 0x10076d8c
jmp 0x10076d4a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10076da0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
jmp 0x10076dd3
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0x1000
jae 0x10076ed8
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
je 0x10076ed8
mov ecx, dword [ebp - 8]
push ecx
push 0x103eb63c
push 8
lea edx, [ebp - 0x18]
push edx
call fcn.10078ef0
add esp, 0x10
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10036640
add esp, 8
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0x24]
shr eax, 1
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x28]
push edx
push str.filepath
mov eax, dword [ebp + 8]
push eax
call fcn.10072a60
add esp, 0x10
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + 0x2c]
shr edx, 1
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x30]
push ecx
push str.basename
mov edx, dword [ebp + 8]
push edx
call fcn.10072a60
add esp, 0x10
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
push ecx
push 0x103eb620
push 0x20
lea edx, [ebp - 0x38]
push edx
call fcn.10078ef0
add esp, 0x10
lea eax, [ebp - 0x38]
push eax
call fcn.1024f510
add esp, 4
push eax
lea ecx, [ebp - 0x38]
push ecx
push str.baseaddr
mov edx, dword [ebp + 8]
push edx
call fcn.100729a0
add esp, 0x10
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
push ecx
call fcn.1007d490
add esp, 4
push eax
push str.imgsize
mov edx, dword [ebp + 8]
push edx
call fcn.10072960
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.10036760
add esp, 4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
jne 0x10076ed3
jmp 0x10076ed8
jmp 0x10076dca
mov esp, ebp
pop ebp
ret

Function at 0x10079610
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x1007962e
xor eax, eax
jmp 0x1007964f
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp dword [edx], 0x4550
je 0x10079649
xor eax, eax
jmp 0x1007964f
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov esp, ebp
pop ebp
ret
Function at 0x10079cb0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10079cda
push str.WARNING:Error_getting_snapshot_handle_to_enumerate_threads.
call fcn.1007c790
add esp, 4
xor eax, eax
jmp 0x10079d3a
mov dword [ebp - 0x24], 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
jne 0x10079d04
push str.WARNING:Error_enumerating_thread_identifiers.
call fcn.1007c790
add esp, 4
xor eax, eax
jmp 0x10079d3a
mov dword [ebp - 8], 0
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp + 8]
jne 0x10079d1b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
jmp 0x10079d2d
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10079d0b
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x1007a430
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x104
push 0
lea eax, [ebp - 0x104]
push eax
call fcn.1024b810
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str._system32_ntdllori.dll
lea edx, [ebp - 0x104]
push edx
call fcn.1025e060
add esp, 8
cmp dword [0x1065dfd4], 0
jne 0x1007a490
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x1065dfd4], eax
push str.NtWriteFile
mov ecx, dword [0x1065dfd4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10500efc], eax
mov esp, ebp
pop ebp
ret
Function at 0x1007ae50
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [0x10500ed0], 0
jne 0x1007aea4
cmp dword [0x1065df9c], 0
jne 0x1007aea4
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
cmp dword [ebp + 0x1c], 0
je 0x1007ae9d
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
xor eax, eax
jmp 0x1007afb1
cmp dword [0x10500ed0], 0
je 0x1007aeb6
mov dword [ebp - 0xc], 1
jmp 0x1007aebd
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
jne 0x1007aee0
push 0
push 0x103ec1b0
push str.pNtFsControlFile_is_NULL_
push 0
call fcn.1007b410
add esp, 0x10
xor eax, eax
jmp 0x1007afb1
cmp dword [0x1065df9c], 0
je 0x1007aef2
mov dword [ebp - 0x10], 1
jmp 0x1007aef9
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0
jne 0x1007af1c
push 0
push 0x103ec18c
push str.pNtWaitForSingleObject_is_NULL_
push 0
call fcn.1007b410
add esp, 0x10
xor eax, eax
jmp 0x1007afb1
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x11c017
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [0x10500ed0]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x103
jne 0x1007af84
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [0x1065df9c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x1007af71
mov dword [ebp - 0x14], 1
jmp 0x1007af78
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
je 0x1007af84
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x1007af93
mov dword [ebp - 0x18], 1
jmp 0x1007af9a
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0
je 0x1007afae
cmp dword [ebp + 0x1c], 0
je 0x1007afae
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp - 0x1c]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1007d490
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
cmp eax, dword [0x10537848]
jne 0x1007d4a8
mov eax, dword [0x10537844]
jmp 0x1007d4ea
cmp dword [ebp + 8], 0
jne 0x1007d4b2
xor eax, eax
jmp 0x1007d4ea
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movzx eax, word [edx]
cmp eax, 0x5a4d
je 0x1007d4c9
xor eax, eax
jmp 0x1007d4ea
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1007d4e4
xor eax, eax
jmp 0x1007d4ea
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x50]
mov esp, ebp
pop ebp
ret