joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100474f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov dword [ebp - 8], ecx
xor eax, eax
mov dword [ebp - 0x10], eax
mov word [ebp - 0xc], ax
push 0x208
push 0
lea ecx, [ebp - 0x42c]
push ecx
call fcn.1024a9c0
add esp, 0xc
mov edx, 2
shl edx, 0
mov eax, 0x3a
mov word [ebp + edx - 0x10], ax
push 3
mov ecx, dword [ebp - 8]
call fcn.10047960
mov byte [ebp - 1], 0x61
jmp 0x10047546
mov cl, byte [ebp - 1]
add cl, 1
mov byte [ebp - 1], cl
movsx edx, byte [ebp - 1]
cmp edx, 0x7a
jg 0x10047603
movsx ax, byte [ebp - 1]
mov ecx, 2
imul edx, ecx, 0
mov word [ebp + edx - 0x10], ax
push 0x104
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jbe 0x100475fe
movsx edx, byte [ebp - 1]
push edx
call fcn.1025ba94
add esp, 4
mov ecx, 2
imul edx, ecx, 0
mov word [ebp + edx - 0x224], ax
mov eax, 2
shl eax, 0
mov ecx, 0x3a
mov word [ebp + eax - 0x224], cx
mov edx, 2
shl edx, 1
xor eax, eax
mov word [ebp + edx - 0x224], ax
lea ecx, [ebp - 0x42c]
push ecx
call fcn.1025241f
add esp, 4
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x42c]
push edx
push 0x104
lea eax, [ebp - 0x21e]
push eax
call fcn.1025b9bb
add esp, 0xc
lea ecx, [ebp - 0x224]
push ecx
mov ecx, dword [ebp - 8]
call fcn.10047a00
jmp 0x1004753d
mov ecx, dword [ebp - 8]
call fcn.10047740
mov esp, ebp
pop ebp
ret
Function at 0x10050380
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x104f353c], 0
je 0x10050392
jmp 0x10050527
push 0x1030848c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100503ab
jmp 0x10050527
push 0x10308498
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f352c], eax
push 0x103084ac
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f3558], eax
push 0x103084c0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f3548], eax
push 0x103084d0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f3560], eax
push 0x103084e0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f3544], eax
push 0x103084f0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f3568], eax
push 0x10308508
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f3554], eax
push 0x10308524
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f3564], eax
push 0x10308540
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f355c], eax
push 0x1030855c
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f354c], eax
push 0x10308574
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f3550], eax
push 0x10308584
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f3530], eax
push str.NtSetInformationThread
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f3538], eax
push str.NtSuspendProcess
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f3534], eax
push 0x103085c0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f3540], eax
push str.NtOpenSymbolicLinkObject
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f3520], eax
push str.NtQuerySymbolicLinkObject
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f3524], eax
push 0x1030860c
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f353c], eax
push 0x10308624
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x104f3528], eax
mov esp, ebp
pop ebp
ret
Function at 0x10050c50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
mov byte [ebp - 1], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
movzx eax, byte [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.10051bf0
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10249426
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + 0x38], eax
mov ecx, dword [ebp - 8]
call fcn.10051db0
movzx ecx, al
test ecx, ecx
je 0x10050dc7
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x3c]
push eax
call fcn.10055540
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x44], eax
push 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x38]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10050dbf
mov byte [ebp - 1], 1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x38]
push ecx
mov ecx, dword [ebp - 8]
call fcn.100517f0
mov ecx, dword [ebp - 8]
call fcn.10050a10
movzx edx, al
test edx, edx
je 0x10050dbf
movzx eax, byte [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.10051b70
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x10]
jae 0x10050dbf
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x44], 0
jbe 0x10050d4a
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x44]
cmp edx, dword [ebp - 0x10]
jae 0x10050d4a
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x44]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.10249421
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.10249426
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 0x38], ecx
push 0
push 0
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x38]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10050dbf
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x38]
push eax
mov ecx, dword [ebp - 8]
call fcn.100517f0
mov ecx, dword [ebp - 8]
call fcn.10051ea0
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 4
Function at 0x10052a40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x2c]
push ecx
call fcn.10249426
add esp, 4
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov dword [edx + 0x28], eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x28]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10052aae
mov dword [ebp - 8], 1
jmp 0x10052ab5
mov dword [ebp - 8], 0
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x10053970
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ecx
mov byte [ebp - 1], 0
mov ecx, dword [ebp - 8]
call fcn.10053a40
movzx eax, al
test eax, eax
jne 0x10053993
xor al, al
jmp 0x10053a33
mov ecx, dword [ebp - 8]
call fcn.10051db0
movzx ecx, al
test ecx, ecx
je 0x10053a30
mov ecx, dword [ebp - 8]
call fcn.10051c10
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x3c]
push eax
call fcn.10055540
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 0x30], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x30]
push ecx
call fcn.10249426
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x2c], eax
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x30]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x2c]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10053a28
mov byte [ebp - 1], 1
mov ecx, dword [ebp - 8]
call fcn.10051ea0
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x10055540
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0xffffffff
je 0x10055582
cmp dword [ebp + 8], 0
je 0x10055582
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x10055578
xor eax, eax
xor edx, edx
jmp 0x10055586
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
jmp 0x10055586
xor eax, eax
xor edx, edx
mov esp, ebp
pop ebp
ret

Function at 0x10055590
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0xffffffff
je 0x10055609
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x100555e1
cmp dword [ebp - 8], 0
je 0x100555e1
xor al, al
jmp 0x1005560b
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10055603
mov al, 1
jmp 0x1005560b
xor al, al
jmp 0x1005560b
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x10055610
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0xffffffff
je 0x1005568f
cmp dword [ebp + 0x14], 0
je 0x1005568f
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10055667
cmp dword [ebp - 8], 0
je 0x10055667
xor al, al
jmp 0x10055691
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10055689
mov al, 1
jmp 0x10055691
xor al, al
jmp 0x10055691
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x10060fd0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
cmp dword [ebp + 0x10], 0
jle 0x10061008
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 8]
add edx, 8
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 8]
mov edx, dword [eax - 4]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
jmp 0x10061010
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], ecx
cmp dword [ebp + 0x10], 0
jle 0x10061045
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 8]
add eax, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx - 8]
mov eax, dword [ecx - 4]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
jmp 0x1006104d
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], edx
cmp dword [ebp + 0x10], 0
jle 0x10061082
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 8]
add ecx, 8
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx - 8]
mov ecx, dword [edx - 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
jmp 0x1006108a
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], eax
cmp dword [ebp + 0x10], 0
jle 0x100610bf
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 8]
add edx, 8
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 8]
mov edx, dword [eax - 4]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edx
jmp 0x100610c7
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], ecx
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 8]
add eax, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
sub eax, 8
cdq
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
mov eax, dword [ebp + 0x10]
cdq
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0xc], 0
xor ecx, ecx
mov word [ebp - 4], cx
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 0xc], esp
and esp, 0xfffffff0
push 0x33
call fcn.10061121

Function at 0x100611b0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x33
call fcn.100611bd
Function at 0x10061ab0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov dword [ebp - 0xac], 0x94
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x10061ae8
push str.WoW64fix:_Failed_to_get_OS_version
call fcn.1003ebe0
add esp, 4
xor eax, eax
jmp 0x10061c55
cmp dword [ebp - 0xa8], 6
jne 0x10061afa
cmp dword [ebp - 0xa4], 1
ja 0x10061b03
cmp dword [ebp - 0xa8], 6
jbe 0x10061b25
mov ecx, dword [ebp - 0xa4]
push ecx
mov edx, dword [ebp - 0xa8]
push edx
push str.WoW64fix:_Windows_version__d._d_not_supported._n
call fcn.1003d460
add esp, 0xc
xor eax, eax
jmp 0x10061c55
push 0x1065f3e8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [0x1065f3e8], 0
jne 0x10061b54
push str.WoW64_not_detected._n
call fcn.1003d460
add esp, 4
xor eax, eax
jmp 0x10061c55
push 0x103e4a6c
call fcn.100614b0
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push str.wow64.dll
call fcn.100614b0
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push str.Wow64PrepareForException
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.100614f0
add esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push 0x103e4794
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.100614f0
add esp, 0xc
mov dword [0x1065f3d8], eax
mov dword [0x1065f3dc], edx
push str.NtSetContextThread
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.100614f0
add esp, 0xc
mov dword [0x1065f3d0], eax
mov dword [0x1065f3d4], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [0x1065f3d4]
push edx
mov eax, dword [0x1065f3d0]
push eax
mov ecx, dword [0x1065f3dc]
push ecx
mov edx, dword [0x1065f3d8]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
push str.WoW64_detected:_64_bit_ntdll_base:_0x_x__KiUserExceptionDispatcher:_0x_x__NtSetContextThread:_0x_x__Wow64PrepareForException:_0x_x_n
call fcn.1003d460
add esp, 0x24
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [0x1065f3d0]
push eax
mov ecx, dword [0x1065f3d8]
push ecx
call fcn.10061780
add esp, 0xc
mov dword [0x1065f3e0], eax
mov dword [0x1065f3e4], edx
call fcn.100619c0
mov edx, dword [0x1065f3e4]
push edx
mov eax, dword [0x1065f3e0]
push eax
push str.WoW64_workaround:_KiUserExceptionDispatcher_hook_installed_at:_0x_x_n
call fcn.1003d460
add esp, 0xc
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10066920
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x110c
call fcn.10249b80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.C:cuckoo__lu.ini
lea eax, [ebp - 0x10c]
push eax
call fcn.100011d0
add esp, 0xc
push 0x2780
push 0
push 0x104f0658
call fcn.1024a9c0
add esp, 0xc
mov dword [0x104f2dd0], 1
mov dword [0x104f0e3c], 1
mov dword [0x104f0e30], 0x1065cb20
push 0x103e5fd4
lea ecx, [ebp - 0x10c]
push ecx
call fcn.1025c353
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1006699f
or eax, 0xffffffff
jmp 0x10066a27
mov edx, dword [ebp - 8]
push edx
push 0x1000
lea eax, [ebp - 0x110c]
push eax
call fcn.1025c657
add esp, 0xc
test eax, eax
je 0x10066a0c
push 0xd
lea ecx, [ebp - 0x110c]
push ecx
call fcn.1024c8f0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100669db
mov edx, dword [ebp - 4]
mov byte [edx], 0
push 0xa
lea eax, [ebp - 0x110c]
push eax
call fcn.1024c8f0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100669fb
mov ecx, dword [ebp - 4]
mov byte [ecx], 0
lea edx, [ebp - 0x110c]
push edx
call fcn.10062a90
add esp, 4
jmp 0x1006699f
mov eax, dword [ebp - 8]
push eax
call fcn.1025c3e1
add esp, 4
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10066a40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x104ff894]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10066a77
push 0x44
call fcn.100736a0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [0x104ff894]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x100675b0
Capabilities:
Delete file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [0x104fff44], eax
cmp dword [ebp + 8], 0
je 0x100675d4
mov ecx, dword [ebp + 8]
push ecx
call fcn.1024e6c0
add esp, 4
test eax, eax
jne 0x100675d9
jmp 0x10067688
push 0x103e7dd4
mov edx, dword [ebp + 8]
push edx
call fcn.1025c353
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10067688
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.1025cf52
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.1025cc8b
add esp, 4
mov dword [ebp - 8], eax
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.1025cf52
add esp, 0xc
push 4
push 0x3000
mov eax, dword [ebp - 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10067672
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.1025d153
add esp, 0x10
mov ecx, dword [ebp - 8]
shr ecx, 3
push ecx
push 8
mov edx, dword [ebp - 0xc]
push edx
push 0x104ff99c
call fcn.10073ae0
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.1025c3e1
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esp, ebp
pop ebp
ret
Function at 0x1006eb90
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x1006ebe9
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1006ebe9
push str.python.exe
mov eax, dword [ebp - 4]
push eax
call fcn.10078510
add esp, 8
test eax, eax
jne 0x1006ebd3
push str.pythonw.exe
mov ecx, dword [ebp - 4]
push ecx
call fcn.10078510
add esp, 8
test eax, eax
je 0x1006ebdf
mov dword [0x10505150], 0
jmp 0x1006ebe9
mov dword [0x10505150], 1
mov esp, ebp
pop ebp
ret

Function at 0x1006f560
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0x1065cac0
call fcn.100733e0
add esp, 4
push 0x1065cae0
call fcn.100733e0
add esp, 4
mov eax, dword [ebp + 8]
mov dword [0x1065cb04], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1007c670
add esp, 4
add eax, dword [0x1065cb04]
mov dword [0x1065ca64], eax
push 0x103e8f04
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x1065cb08], eax
mov edx, dword [0x1065cb08]
push edx
call fcn.1007c670
add esp, 4
add eax, dword [0x1065cb08]
mov dword [0x1065cafc], eax
push 0x105051ac
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
call fcn.1006f1e0
cmp dword [0x104ff4e0], 0
jne 0x1006f5f0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x104ff4e0], eax
xor eax, eax
pop ebp
ret

Function at 0x10073170
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
call fcn.10075a40
mov dword [ebp - 4], eax
push 0x7fff
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x7fff
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x105053fc], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov dword [ebp - 8], 0
push 0x1000
call fcn.100735f0
add esp, 4
push eax
lea ecx, [ebp - 0xb8]
push ecx
call fcn.100352b0
add esp, 8
push str.modules
lea edx, [ebp - 0xb8]
push edx
call fcn.10035c60
add esp, 8
lea eax, [ebp - 0xb8]
push eax
call fcn.10075f80
add esp, 4
lea ecx, [ebp - 0xb8]
push ecx
call fcn.10035dc0
add esp, 4
lea edx, [ebp - 0xb8]
push edx
call fcn.100355e0
add esp, 4
lea eax, [ebp - 0xb8]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.10075dc0
push eax
call fcn.1007a490
push eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0
push 1
call fcn.100336e0
push eax
call fcn.100724e0
add esp, 0x3c
lea ecx, [ebp - 0xb8]
push ecx
call fcn.100356b0
add esp, 4
mov edx, dword [ebp - 4]
push edx
call fcn.10075b80
add esp, 4
mov esp, ebp
pop ebp
ret