joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405cfc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405d62
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004044ac
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402f40
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405d4c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405d69
lea eax, [ebp - 0x10]
call fcn.0040423c
ret

Function at 0x4078f0
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.004046fc
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x407912
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40a134
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a16d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040432c
jmp 0x40a176
mov eax, ebx
mov edx, esi
call fcn.00404290
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a180
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40a1a1
mov al, byte [esp]
jmp 0x40a1a3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40a838
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40a6a0
mov eax, dword [0x41b5e0]
cmp byte [eax], 0
je 0x40a8b4
mov eax, dword [0x41b4e4]
call fcn.00402e30
call fcn.00402b08
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00407a74
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40a8fc
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40a8ea
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x41b4c0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x41c660]
call fcn.004051a4
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40b5fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40b660
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004044ac
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004075e8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b667
lea eax, [ebp - 0xc]
call fcn.0040423c
ret

Function at 0x416ef8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push esi
push edi
push eax
push edx
mov eax, dword [eax]
mov edx, dword [edx]
mov ebx, 0
mov esi, 0
mov edi, dword [0x41d904]
shl edi, 2
xor edx, dword [esi + 0x41c87c]
ror edx, 0x10
mov bl, dh
mov ecx, dword [ebx*4 + 0x41c904]
mov bl, dl
add ecx, dword [ebx*4 + 0x41cd04]
rol edx, 0x10
mov bl, dh
xor ecx, dword [ebx*4 + 0x41d104]
mov bl, dl
add ecx, dword [ebx*4 + 0x41d504]
xor eax, ecx
xchg edx, eax
add esi, 4
cmp esi, edi
jne 0x416f15
xchg edx, eax
xor eax, dword [esi + 0x41c87c]
xor edx, dword [esi + 0x41c880]
mov ebx, edx
pop edx
mov dword [edx], ebx
mov ebx, eax
pop eax
mov dword [eax], ebx
pop edi
pop esi
pop ecx
pop ebx
ret

Function at 0x416f70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push esi
push eax
push edx
mov eax, dword [eax]
mov edx, dword [edx]
mov ebx, 0
mov esi, dword [0x41d904]
inc esi
shl esi, 2
xor edx, dword [esi + 0x41c87c]
ror edx, 0x10
mov bl, dh
mov ecx, dword [ebx*4 + 0x41c904]
mov bl, dl
add ecx, dword [ebx*4 + 0x41cd04]
rol edx, 0x10
mov bl, dh
xor ecx, dword [ebx*4 + 0x41d104]
mov bl, dl
add ecx, dword [ebx*4 + 0x41d504]
xor eax, ecx
xchg edx, eax
sub esi, 4
cmp esi, 4
jne 0x416f88
xchg edx, eax
xor eax, dword [0x41c880]
xor edx, dword [0x41c87c]
mov ebx, edx
pop edx
mov dword [edx], ebx
mov ebx, eax
pop eax
mov dword [eax], ebx
pop esi
pop ecx
pop ebx
ret
Function at 0x417268
Capabilities:
Encrypt data using blowfish

Disassembly:
push esi
push edi
mov dword [0x41d904], 0x10
mov esi, 0x41a3bc
mov edi, 0x41c87c
mov ecx, 0x422
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
ret

Function at 0x418b88
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x418bce
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00418aec
mov eax, dword [ebp - 4]
call fcn.004046fc
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418bd5
lea eax, [ebp - 4]
call fcn.0040423c
ret

Function at 0x418c98
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00407b88
add esp, 0x104
pop ebx
ret

Function at 0x418f4c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0
push 0
push 0x1c
push 0
call sub.SHFolder.dll_SHGetFolderPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x101
call fcn.004044ac
add esp, 0x104
pop ebx
ret
Function at 0x405b0c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00405fbc
mov byte [esp], al
cmp byte [esp], 0
jne 0x405c95
test edi, edi
je 0x405c95
mov byte [esp + 1], 0
test ebp, ebp
jle 0x405bd5
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x405bb0
cmp edi, 0xffffffff
je 0x405b71
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x405b71
mov byte [esp], 0
jmp 0x405c95
cmp dword [esi], 1
jg 0x405bb0
cmp dword [esi], 0
jne 0x405ba2
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x405ba2
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x405c95
lea eax, [esp + 0xc]
call fcn.004057a4
dec ebp
test ebp, ebp
jg 0x405b56
cmp edi, 0xffffffff
je 0x405bd5
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x405bd3
mov byte [esp], 0
jmp 0x405c95
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x405b1a
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x405bd5
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00405d10
mov edx, eax
mov ebx, dword [0x40e8e4]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x405c39
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x405c37
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x405c39
xor edi, edi
cmp byte [esp], 0
je 0x405c5f
mov ebx, dword [esi]
test bl, 1
jne 0x405c75
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x405c3f
mov byte [esp + 1], 1
jmp 0x405c75
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x405c5f
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x405bec
cmp byte [esp], 0
je 0x405c95
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4067e8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40e040], 0
je 0x40684f
cmp word [0x40e330], 0xd7b2
jne 0x406811
cmp dword [0x40e338], 0
jbe 0x406811
mov eax, 0x40e32c
call dword [0x40e348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x40687c
call fcn.00406e2c
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x40d01e], 0
jne 0x40686b
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4092bc
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x40c110
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov eax, dword [0x40d848]
mov byte [eax], 1
mov eax, 0x40a0cc
call fcn.00409a04
xor eax, eax
push ebp
push 0x40c306
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetCommandLineW
mov ebx, eax
test ebx, ebx
jne 0x40c166
mov eax, dword [0x40d844]
mov edx, 0x40c320
call fcn.00404c60
call fcn.00404d64
call fcn.00403da4
mov eax, 1
call fcn.004069b0
xor edx, edx
jmp 0x40c192
cmp ax, 0x22
jne 0x40c185
test dl, dl
je 0x40c180
cmp word [ebx + 2], 0x22
jne 0x40c180
add ebx, 2
jmp 0x40c18f
xor dl, 1
jmp 0x40c18f
cmp word [ebx], 0x20
ja 0x40c18f
test dl, dl
je 0x40c19a
add ebx, 2
movzx eax, word [ebx]
test ax, ax
jne 0x40c16a
cmp word [ebx], 0
je 0x40c1b3
jmp 0x40c1a5
add ebx, 2
movzx eax, word [ebx]
test ax, ax
je 0x40c1b3
cmp ax, 0x20
jbe 0x40c1a2
cmp word [ebx], 0
je 0x40c2d2
mov eax, 0x4115ec
mov edx, ebx
call fcn.00406edc
mov eax, 0x4115f0
xor ecx, ecx
mov edx, 0xc
call fcn.004047cc
mov dword [0x4115f0], 0xc
mov dword [0x4115f8], 0xffffffff
mov eax, 0x4115a8
xor ecx, ecx
mov edx, 0x44
call fcn.004047cc
push 0x411598
push 0x4115a8
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0x4115f0
mov eax, dword [0x4115ec]
call fcn.00406ecc
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x40c25f
mov eax, dword [0x41159c]
push eax
call sub.kernel32.dll_CloseHandle
push 0xffffffffffffffff
mov eax, dword [0x411598]
push eax
call sub.user32.dll_WaitForInputIdle
mov eax, dword [0x411598]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x40d840]
xor edx, edx
mov dword [eax], edx
jmp 0x40c2f6
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, 0x4115ec
mov edx, 0x400
call fcn.00406f38
mov esi, dword [0x4115ec]
test esi, esi
je 0x40c282
mov esi, dword [esi - 4]
push 0
push esi
mov eax, dword [0x4115ec]
call fcn.00406ecc
push eax
push 0
push ebx
push 0
push 0x3200
call sub.kernel32.dll_FormatMessageW
mov edx, eax
mov eax, 0x4115ec
call fcn.00406f38
mov eax, dword [0x40d844]
mov edx, dword [0x4115ec]
call fcn.00404c60
call fcn.00404d64
call fcn.00403da4
mov eax, dword [0x40d840]
mov dword [eax], 1
jmp 0x40c2f6
mov eax, dword [0x40d844]
mov edx, 0x40c368
call fcn.00404c60
call fcn.00404d64
call fcn.00403da4
mov eax, dword [0x40d840]
mov dword [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c30d
pop eax
jmp eax
Function at 0x1003af9
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test byte [0x100b304], 1
push ebx
push esi
push edi
jne 0x1003b1c
or dword [0x100b304], 1
call fcn.01003aa5
mov dword [0x100b300], eax
push 4
pop eax
call fcn.01006230
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1003ba8
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x100b25c]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x1003ba8
cmp eax, 1
je 0x1003bc0
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1003ba8
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x1003b7d
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x1003ba4
xor eax, eax
inc eax
jmp 0x1003bdc
cmp esi, ebx
jae 0x1003bac
xor eax, eax
jmp 0x1003bdc
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x100b25c]
jmp 0x1003bc2
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100468d
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
mov esi, ecx
call fcn.01008701
cmp eax, edi
mov dword [esi + 0x88], eax
je 0x10046d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10046d8
lea eax, [esp + 8]
push eax
push edi
push esi
push 0x1004650
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
cmp eax, edi
setne cl
mov dword [0x100b2fc], eax
mov eax, ecx
jmp 0x10046eb
mov esi, dword [esi + 0x88]
cmp esi, edi
je 0x10046e9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ecx
ret
Function at 0x1005824
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor ebx, ebx
push 2
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
call fcn.01008b1d
mov esi, eax
cmp esi, ebx
mov dword [ebp - 8], esi
jne 0x1005876
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1005861
call esi
mov esi, eax
jmp 0x100598e
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x100598e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.01008787
mov edi, eax
cmp edi, ebx
je 0x1005896
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
cmp esi, ebx
jne 0x10058be
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10058a9
call esi
jmp 0x1005983
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1005985
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp byte [ebx + esi], 0
mov edi, esi
je 0x100592c
lea edi, [ebx + 1]
cmp edi, 0x400
ja 0x10058f9
push edi
call fcn.01003be4
test al, al
je 0x10058f9
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.01006230
mov dword [ebp + 8], esp
jmp 0x1005905
push edi
lea ecx, [ebp - 4]
call fcn.01004d40
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x1005913
mov esi, 0x8007000e
jmp 0x1005985
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov byte [eax + ebx], 0
test edi, edi
jne 0x1005934
xor eax, eax
jmp 0x1005977
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea ebx, [esi + esi]
cmp ebx, 0x400
ja 0x1005964
push ebx
call fcn.01003be4
test al, al
je 0x1005964
mov eax, ebx
add eax, 3
and eax, 0xfffffffc
call fcn.01006230
mov eax, esp
jmp 0x100596d
push ebx
lea ecx, [ebp - 4]
call fcn.01004d40
push 0
push esi
push edi
push eax
call fcn.01003c3d
push dword [ebp + 0x14]
lea ecx, [ebp - 0x10]
push eax
call fcn.010055ce
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 4]
call fcn.01004636
mov eax, esi
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1005b78
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x100b0dc]
xor eax, dword [ebp + 4]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0
mov dword [ebp + 0x10], eax
call fcn.01008a5f
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x1001310
push esi
mov ebx, 0x100b268
push 0x100b078
mov ecx, ebx
call fcn.010046ef
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, 0x10017fc
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
mov dword [0x100b2ec], eax
lea eax, [ebp - 0x140]
push eax
movsw word es:[edi], word [esi]
mov dword [ebp - 0x140], 0x114
call fcn.0100933e
test eax, eax
je 0x1005c01
xor eax, eax
cmp dword [ebp - 0x130], 1
sete al
mov dword [0x100b2f8], eax
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push dword [ebp + 0x10]
mov dword [ebp - 8], esi
jmp 0x1005c45
push 0x10017e4
push edi
call fcn.01003a3b
test eax, eax
jne 0x1005c7a
push 0x10017d0
push edi
call fcn.01003a3b
test eax, eax
jne 0x1005c8f
push 0x10017bc
push edi
call fcn.01003a3b
test eax, eax
jne 0x1005cd2
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.01003a5f
mov edi, eax
cmp edi, esi
jne 0x1005c0f
mov ecx, ebx
call fcn.0100468d
test eax, eax
je 0x1005cd2
push 1
push 4
push ebx
call fcn.010044ee
cmp dword [0x100b2f8], esi
je 0x1005cb1
push 0x100b27c
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x1005cb1
push esi
push esi
push 0x64
push ebx
call fcn.01005a00
push esi
push 1
push ebx
call fcn.01005514
jmp 0x1005ca3
push esi
push 1
push 0x64
push ebx
call fcn.01005a00
push esi
push 1
push ebx
call fcn.01005469
mov dword [ebp - 8], eax
jmp 0x1005cd2
lea eax, [ebp - 0x2c]
push eax
call fcn.01008772
push esi
push esi
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.010089b0
test eax, eax
jne 0x1005ca8
push ebx
call fcn.0100453b
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call fcn.01004581
mov eax, dword [0x100b2fc]
cmp eax, esi
je 0x1005cee
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x100b2fc], esi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
call fcn.01006023
leave
ret 0x10
Function at 0x1006031
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1001880
call fcn.01006270
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp word [0x1000000], 0x5a4d
jne 0x1006079
mov eax, dword [0x100003c]
lea eax, [eax + 0x1000000]
cmp dword [eax], 0x4550
jne 0x1006079
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x1006092
cmp ecx, 0x20b
je 0x100607f
and dword [ebp - 0x60], 0
jmp 0x10060a6
cmp dword [eax + 0x84], 0xe
jbe 0x1006079
xor ecx, ecx
cmp dword [eax + 0xf8], ecx
jmp 0x10060a0
cmp dword [eax + 0x74], 0xe
jbe 0x1006079
xor ecx, ecx
cmp dword [eax + 0xe8], ecx
setne cl
mov dword [ebp - 0x60], ecx
and dword [ebp - 4], 0
push 2
pop esi
push esi
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or edi, 0xffffffff
mov dword [0x100c1ac], edi
mov dword [0x100c1b0], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x100b338]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100b334]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100c1b4], eax
call fcn.010062e0
cmp dword [0x100b0e0], 0
jne 0x1006106
push fcn.010062e0
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010062ce
push 0x100b01c
push 0x100b018
call sub.msvcrt.dll__initterm
mov eax, dword [0x100b330]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x64]
push eax
push dword [0x100b32c]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x74], eax
push 0x100b014
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], 0
jne 0x100616a
mov dword [ebp - 4], edi
mov eax, 0xff
jmp 0x100621b
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
cmp word [eax], 0x22
jne 0x10061ad
add eax, esi
mov dword [ebp - 0x78], eax
mov cx, word [eax]
test cx, cx
je 0x1006188
cmp cx, 0x22
jne 0x1006175
cmp word [eax], 0x22
jne 0x1006193
add eax, esi
mov dword [ebp - 0x78], eax
mov cx, word [eax]
test cx, cx
je 0x10061a1
cmp cx, 0x20
jbe 0x100618e
test byte [ebp - 0x30], 1
je 0x10061ba
movzx ecx, word [ebp - 0x2c]
jmp 0x10061bd
cmp word [eax], 0x20
jbe 0x1006193
add eax, esi
mov dword [ebp - 0x78], eax
jmp 0x10061ad
push 0xa
pop ecx
push ecx
push eax
push 0
push 0x1000000
call fcn.01005b78
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x60], 0
jne 0x10061dd
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x1006219
mov eax, esi
call fcn.010062ab
ret