joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001170
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push str.micro.dat
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100011a0
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x10]
push 0
push eax
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push esi
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
call edi
mov edx, dword [ebp - 8]
test edx, edx
jne 0x100011d9
push edx
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov ecx, esi
call fcn.10001050
mov ecx, dword [0x10013184]
push 0
mov dword [ecx + 0xb24], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push esi
call edi
mov edx, dword [ebp - 0xc]
test edx, edx
jne 0x10001209
push edx
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov ecx, esi
call fcn.10001050
mov ecx, dword [0x10013184]
push 0
mov dword [ecx + 0xb2c], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 4]
push eax
push esi
call edi
mov edx, dword [ebp - 4]
mov ecx, esi
call fcn.10001050
mov edx, eax
mov eax, dword [0x10013184]
pop edi
cmp dword [eax + 0xb24], 0
je 0x10001198
cmp dword [eax + 0xb2c], 0
je 0x10001198
test edx, edx
je 0x10001198
cmp dword [ebp - 4], 0x502
je 0x10001270
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
xor eax, eax
xor byte [eax + edx], 0xc3
inc eax
mov ecx, dword [ebp - 4]
cmp eax, ecx
jb 0x10001272
push ecx
push edx
push dword [0x10013184]
call fcn.1000abb0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10035ae
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100a1c4]
push ebx
push edi
mov dword [ebp - 4], eax
xor eax, eax
xor ebx, ebx
and word [ebp - 0x208], bx
and dword [ebp - 0x20c], ebx
mov ecx, 0x80
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x208]
push eax
mov dword [ebp - 0x210], 0x202
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1003642
lea eax, [ebp - 0x20c]
push eax
push 1
lea eax, [ebp - 0x208]
push eax
push 0
call sub.NETAPI32.dll_NetUserGetInfo
test eax, eax
mov eax, dword [ebp - 0x20c]
jne 0x1003636
test eax, eax
je 0x1003640
mov ecx, dword [eax + 0xc]
and ecx, 3
cmp cl, 2
jne 0x1003636
xor ebx, ebx
inc ebx
test eax, eax
je 0x1003640
push eax
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.01007a24
leave
ret
Function at 0x1005014
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100a1c4]
and word [ebp - 0x20c], 0
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x100278c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 3
pop ecx
cmp ecx, eax
mov ecx, dword [ebp - 4]
sbb eax, eax
neg eax
pop edi
call fcn.01007a24
leave
ret
Function at 0x1005305
Capabilities:
Copy file
Delete file
Get common file path
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x100a1c4]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp word [edi + 2], 0x3a
mov dword [ebp - 4], eax
jne 0x100532c
movzx eax, word [edi]
jmp 0x1005347
push 0x100
lea eax, [ebp - 0x61c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movzx eax, word [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push 0x1002868
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x1002860
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x1005380
xor al, al
jmp 0x10053d0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
lea eax, [ebp - 0x20c]
push eax
push edi
call esi
test eax, eax
jne 0x100539b
xor al, al
jmp 0x10053cf
push 4
push 0
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x1005397
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
push edi
push ebx
call esi
test eax, eax
je 0x1005397
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.01007a24
leave
ret 8

Function at 0x10053e3
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
or dword [ebp + 8], 0xffffffff
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1005460
cmp dword [ebp + 0x10], esi
mov dword [ebp + 8], esi
je 0x100544a
push 0x927c0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
pop edi
pop esi
leave
ret 0xc
Function at 0x100546e
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x100a1c4]
and word [ebp - 0x414], 0
and word [ebp - 0x20c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
mov edx, 0x81
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x412]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x208
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x620], esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x100297c
lea eax, [ebp - 0x414]
push eax
call ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x20c]
push 0x100296c
push eax
call esi
add esp, 0xc
push 1
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.010053e3
mov edx, 0x82
mov dword [ebp - 0x628], eax
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x414]
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0x20c]
rep stosd dword es:[edi], eax
push 0x208
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x1002940
lea eax, [ebp - 0x414]
push eax
call ebx
push dword [ebp - 0x620]
lea eax, [ebp - 0x20c]
push 0x1002928
push eax
call esi
add esp, 0xc
push 0x100290c
lea eax, [ebp - 0x20c]
push eax
call ebx
push 1
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.010053e3
push dword [ebp - 0x620]
mov dword [ebp - 0x624], eax
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x20c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20c]
push 0x10028dc
push eax
call esi
add esp, 0xc
push 1
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.010053e3
xor ebx, ebx
cmp dword [ebp - 0x628], ebx
je 0x1005623
cmp dword [ebp - 0x624], ebx
je 0x1005623
cmp dword [ebp + 0xc], ebx
je 0x1005626
push dword [ebp - 0x620]
xor eax, eax
mov word [ebp - 0x61c], bx
mov ecx, 0x81
lea edi, [ebp - 0x61a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x61c]
push 0x1002878
push eax
call esi
add esp, 0xc
push ebx
push ebx
lea eax, [ebp - 0x61c]
push eax
call sub.MFC42u.dll_AfxMessageBox
jmp 0x1005626
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.01007a24
leave
ret 8
Function at 0x100563c
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100a1c4]
and word [ebp - 0x20c], 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
push 0x208
stosw word es:[edi], ax
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push 0x10029b0
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
mov edi, 0x404
je 0x10056b4
mov ebx, 0x10029e4
push ebx
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
jne 0x10056bb
mov esi, 0x804
jmp 0x10056f8
push 0x10029d8
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x10056df
push 0x10029cc
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
jne 0x10056e3
mov esi, edi
jmp 0x10056f8
push ebx
lea eax, [ebp - 0x20c]
push eax
call esi
mov esi, eax
neg esi
sbb esi, esi
and esi, 5
add esi, edi
mov eax, dword [sym.imp.msvcrt.dll___argc]
cmp dword [eax], 2
jl 0x1005759
mov eax, dword [sym.imp.msvcrt.dll___wargv]
mov eax, dword [eax]
mov ebx, dword [sym.imp.msvcrt.dll_wcsstr]
push 0x10029a8
push dword [eax + 4]
call ebx
test eax, eax
pop ecx
pop ecx
je 0x1005724
mov esi, 0x804
mov eax, dword [sym.imp.msvcrt.dll___wargv]
mov eax, dword [eax]
push 0x10029c4
push dword [eax + 4]
call ebx
test eax, eax
pop ecx
pop ecx
je 0x100573d
mov esi, edi
mov eax, dword [sym.imp.msvcrt.dll___wargv]
mov eax, dword [eax]
push 0x10029bc
push dword [eax + 4]
call ebx
test eax, eax
pop ecx
pop ecx
je 0x1005759
mov esi, 0x409
mov ecx, dword [ebp - 4]
pop edi
mov ax, si
pop esi
pop ebx
call fcn.01007a24
leave
ret

Function at 0x100576e
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10057d9
push esi
lea eax, [ebp - 0xc]
push eax
push 0x10029f0
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x10057cf
mov eax, dword [ebp - 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push esi
push esi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
push 0x80010002
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
leave
ret
Function at 0x10059e6
Capabilities:
Get file size
Parse pe header
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp + 8], edi
jne 0x1005a17
xor eax, eax
inc eax
jmp 0x1005af2
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push esi
push esi
push 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 4], ebx
jne 0x1005a3e
push 2
pop esi
jmp 0x1005ae6
push esi
push esi
push esi
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, esi
jne 0x1005a57
push 3
jmp 0x1005ade
mov esi, dword [edi + 0x3c]
add esi, edi
cmp word [edi], 0x5a4d
jne 0x1005ad5
push 0xe0
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1005ad5
cmp dword [esi], 0x4550
jne 0x1005ad5
movzx ebx, word [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp + 8]
call esi
cmp ebx, 0x14c
je 0x1005ac3
cmp ebx, 0x200
je 0x1005abc
cmp ebx, 0x8664
je 0x1005ab5
push 0x1002aec
jmp 0x1005ac8
push 0x1002ae4
jmp 0x1005ac8
push 0x1002ad8
jmp 0x1005ac8
push 0x1002ad0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
jmp 0x1005af1
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 4
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x1005afd
Capabilities:
Get file size
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 4], edi
jne 0x1005b30
xor eax, eax
inc eax
jmp 0x1005c0b
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push esi
push esi
push 4
push esi
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
cmp ebx, esi
jne 0x1005b53
push 2
jmp 0x1005b71
push esi
push esi
push esi
push 0xf001f
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, esi
jne 0x1005b82
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 3
pop esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x1005c0a
mov esi, dword [edi + 0x3c]
add esi, edi
cmp word [edi], 0x5a4d
jne 0x1005bf2
push 0xe0
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1005bf2
cmp dword [esi], 0x4550
jne 0x1005bf2
mov esi, dword [sym.imp.imagehlp.dll_CheckSumMappedFile]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push edi
call esi
mov ecx, dword [ebp + 8]
mov dword [eax + 0x58], ecx
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push dword [ebp - 4]
call esi
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, 5
jmp 0x1005c0a
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push dword [ebp - 4]
call esi
push 4
pop eax
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x1006dc8
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe24
mov eax, dword [0x100a1c4]
and dword [ebp - 0xe1c], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0x78
mov dword [ebp - 0xe20], ecx
pop ecx
mov dword [ebp - 0xe24], eax
xor eax, eax
lea edi, [ebp - 0x7fc]
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100701d
xor eax, eax
mov ecx, 0x187
lea edi, [ebp - 0xe18]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xe18]
push eax
push esi
call fcn.010050a9
test eax, eax
je 0x100701d
push ebx
push 0x10
lea eax, [ebp - 0xe14]
push eax
lea eax, [ebp - 0x7a4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
and word [ebp - 0x61c], 0
mov ebx, 0x81
xor eax, eax
mov ecx, ebx
lea edi, [ebp - 0x61a]
rep stosd dword es:[edi], eax
push 1
push 0
push esi
stosw word es:[edi], ax
call fcn.01007628
push 1
push 1
push esi
mov edi, eax
call fcn.01007628
lea ecx, [ebp - 0x61c]
push ecx
push eax
push edi
push esi
call fcn.0100757d
and word [ebp - 0x414], 0
mov dword [ebp - 0x624], eax
xor eax, eax
mov ecx, ebx
lea edi, [ebp - 0x412]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x414]
push eax
push esi
call fcn.01005c16
test eax, eax
je 0x1006edc
push dword [ebp - 0x624]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x6a4]
push 0x1002cfc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
and word [ebp - 0x20c], 0
xor eax, eax
mov ecx, ebx
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.010059e6
test eax, eax
pop ebx
jne 0x1006f1a
push 0x10
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x724]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp word [ebp - 0xe14], 0x35
jne 0x1006f6a
cmp word [ebp - 0xe10], 0x31
jb 0x1006ff0
push 0x1002ae4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ecx, dword [ebp - 0xe20]
test eax, eax
lea eax, [ebp - 0x7fc]
push eax
push esi
jne 0x1006f60
call fcn.01006359
jmp 0x1006fea
call fcn.010060ea
jmp 0x1006fea
cmp word [ebp - 0xe14], 0x36
jne 0x1006ff0
cmp word [ebp - 0xe10], 0x30
jne 0x1006fb0
push 0x1002ae4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ecx, dword [ebp - 0xe20]
test eax, eax
lea eax, [ebp - 0x7fc]
push eax
push esi
jne 0x1006fa9
call fcn.010067cd
jmp 0x1006fea
call fcn.010065e2
jmp 0x1006fea
cmp word [ebp - 0xe10], 0x31
jne 0x1006ff0
push 0x1002ae4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ecx, dword [ebp - 0xe20]
test eax, eax
lea eax, [ebp - 0x7fc]
push eax
push esi
jne 0x1006fe5
call fcn.01006bb2
jmp 0x1006fea
call fcn.010069c9
mov dword [ebp - 0xe1c], eax
mov edi, dword [ebp - 0xe20]
mov eax, dword [ebp - 0xe1c]
push 0x78
pop ecx
add edi, 4
lea esi, [ebp - 0x7fc]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xe24]
push 0x78
pop ecx
lea esi, [ebp - 0x7fc]
rep movsd dword es:[edi], dword [esi]
jmp 0x100701f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01007a24
leave
ret 8
Function at 0x10070af
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [ecx]
xor ecx, ecx
cmp dword [eax - 8], ecx
jne 0x10070bb
xor eax, eax
ret
push 1
push ecx
push ecx
push eax
push 0x1002e74
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret

Function at 0x10072f3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push dword [ebp + 0x10]
mov esi, edi
shr esi, 4
inc esi
movzx eax, si
push eax
push 6
push dword [ebp + 8]
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x1007340
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1007340
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x1007340
dec esi
shl esi, 4
sub edi, esi
cmp edi, 0x10
jb 0x1007345
mov eax, dword [ebx + 8]
jmp 0x1007388
mov esi, eax
mov eax, edi
and eax, 0xf
jbe 0x1007358
dec eax
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x100734e
movzx edi, word [esi]
mov eax, dword [ebx + 0xc]
inc esi
inc esi
test eax, eax
je 0x100736c
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
lea eax, [edi + edi + 2]
push eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
inc edi
push edi
push esi
push eax
mov dword [ebx + 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebx + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x10073ba
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x100a690], 0
push esi
push edi
mov esi, ecx
je 0x100746c
mov eax, dword [esi + 0xc]
test eax, eax
je 0x10073df
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0x400
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
test edi, edi
pop ecx
mov dword [esi + 0xc], edi
je 0x100746c
push 0x100a2a8
push 0x200
xor eax, eax
mov ecx, 0x100
rep stosd dword es:[edi], eax
push dword [esi + 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jbe 0x100746c
cmp eax, 5
jbe 0x1007485
lea edi, [eax - 1]
xor edx, edx
test edi, edi
jbe 0x1007485
mov eax, dword [esi + 0xc]
lea eax, [eax + edx*2]
cmp word [eax], 0x5c
jne 0x1007465
mov cx, word [eax + 2]
cmp cx, 0x6e
jne 0x1007450
mov word [eax], 0x20
mov eax, dword [esi + 0xc]
mov word [eax + edx*2 + 2], 0xa
jmp 0x1007465
cmp cx, 0x72
jne 0x1007465
mov word [eax], 0x20
mov eax, dword [esi + 0xc]
mov word [eax + edx*2 + 2], 0xd
inc edx
cmp edx, edi
jb 0x1007429
jmp 0x1007485
xor eax, eax
mov ax, word [0x100a694]
mov ecx, esi
push eax
push dword [ebp + 8]
push dword [0x100a698]
call fcn.010072f3
mov eax, dword [esi + 0xc]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1007a24
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100a1c4]
jne 0x1007a35
test ecx, 0xffff0000
jne 0x1007a35
ret
jmp fcn.01007a3f
Function at 0x10080b7
Capabilities:
Parse pe header

Disassembly:
push 0x70
push 0x1002fe8
call fcn.01008418
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp word [0x1000000], 0x5a4d
jne 0x10080ff
mov eax, dword [0x100003c]
lea eax, [eax + 0x1000000]
cmp dword [eax], 0x4550
jne 0x10080ff
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x1008118
cmp ecx, 0x20b
je 0x1008105
and dword [ebp - 0x1c], 0
jmp 0x100812c
cmp dword [eax + 0x84], 0xe
jbe 0x10080ff
xor ecx, ecx
cmp dword [eax + 0xf8], ecx
jmp 0x1008126
cmp dword [eax + 0x74], 0xe
jbe 0x10080ff
xor ecx, ecx
cmp dword [eax + 0xe8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
and dword [ebp - 4], 0
push 2
pop esi
push esi
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or edi, 0xffffffff
mov dword [0x100a9ec], edi
mov dword [0x100a9f0], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x100a9e0]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100a9dc]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100a9e8], eax
call fcn.0109e000
cmp dword [0x100a1d0], 0
jne 0x100818c
push 0x100840e
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010083f7
push 0x1001440
push 0x100143c
call sub.msvcrt.dll__initterm
mov eax, dword [0x100a9d8]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x100a9d4]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x38], eax
push 0x1001438
push 0x1001428
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov eax, dword [eax]
test eax, eax
jne 0x10081f1
mov dword [ebp - 4], edi
mov eax, 0xff
jmp 0x10082a0
mov dword [ebp - 0x20], eax
cmp word [eax], 0x22
jne 0x1008232
add eax, esi
mov dword [ebp - 0x20], eax
mov cx, word [eax]
test cx, cx
je 0x100820d
cmp cx, 0x22
jne 0x10081fa
cmp word [eax], 0x22
jne 0x1008218
add eax, esi
mov dword [ebp - 0x20], eax
mov cx, word [eax]
test cx, cx
je 0x1008226
cmp cx, 0x20
jbe 0x1008213
test byte [ebp - 0x54], 1
je 0x100823f
movzx ecx, word [ebp - 0x50]
jmp 0x1008242
cmp word [eax], 0x20
jbe 0x1008218
add eax, esi
mov dword [ebp - 0x20], eax
jmp 0x1008232
push 0xa
pop ecx
push ecx
push eax
push 0
push 0x1000000
call fcn.010085fd
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], 0
jne 0x1008262
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x100829e
mov eax, esi
call fcn.01008453
ret