joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002ae60
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
mov dword [esp + 0xc], ebx
call fcn.10029970
mov ecx, esi
call fcn.1002a800
lea eax, [esp + 0xc]
push eax
push ebx
push esi
push 0x10029680
push ebx
push ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [esp + 0x14]
mov dword [esi + 0x144], eax
push 0xffffffffffffffff
push ebx
add esi, 0xec
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
push esi
mov ecx, edi
mov byte [edi + 4], bl
call fcn.10001e90
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret 4

Function at 0x1002b720
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ecx
push ebx
push esi
push edi
push 0x1000
mov dword [esp + 0x10], 0x1000
call fcn.1003ea53
mov ebx, dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push esi
push 0
call ebx
mov edi, eax
test edi, edi
jne 0x1002b784
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1002b7ef
push esi
call fcn.100404b3
mov ecx, dword [esp + 0x10]
push ecx
call fcn.1003ea53
add esp, 8
lea edx, [esp + 0xc]
push edx
mov esi, eax
push esi
push edi
call ebx
mov edi, eax
test edi, edi
je 0x1002b7ef
mov ebx, dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
push ebp
mov ebp, dword [esp + 0x18]
nop
mov eax, dword [esi + 4]
push ebp
push eax
call fcn.10040e10
add esp, 8
test eax, eax
je 0x1002b7ab
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea edx, [esp + 0x10]
push edx
push esi
push edi
call ebx
test eax, eax
jne 0x1002b790
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1002b7e5
push esi
call fcn.100404b3
mov eax, dword [esp + 0x14]
push eax
call fcn.1003ea53
add esp, 8
lea ecx, [esp + 0x10]
push ecx
mov esi, eax
push esi
push edi
call ebx
test eax, eax
jne 0x1002b790
push esi
call fcn.100404b3
add esp, 4
pop ebp
pop edi
pop esi
mov al, 1
pop ebx
pop ecx
ret 4

Function at 0x1002b8d0
Capabilities:
Resolve dns

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
test eax, eax
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
jle 0x1002b959
mov ebx, dword [esp + 0x18]
lea esp, [esp]
xor ebp, ebp
xor edi, edi
mov esi, dword [ebx + 4]
test esi, esi
jne 0x1002b8ff
xor eax, eax
jmp 0x1002b917
mov ecx, dword [ebx + 8]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebp, eax
jge 0x1002b93d
cmp dword [edi + esi + 0x18], 0x10
jb 0x1002b928
mov esi, dword [edi + esi + 4]
jmp 0x1002b92c
lea esi, [edi + esi + 4]
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x1002b963
inc ebp
add edi, 0x1c
jmp 0x1002b8f4
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x1002b8f0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 0xc
Function at 0x1002b9f0
Capabilities:
Get disk information

Disassembly:
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push 0x100537c4
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push ebp
push ebp
push 0x100537e4
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov ecx, esi
call fcn.1002b970
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [esi + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esi + 4]
push ecx
mov dword [esi + 0x10], ebp
call edi
mov edx, dword [esi + 0x14]
push edx
mov dword [esi + 4], ebp
call edi
mov eax, dword [esi + 0x18]
cmp eax, ebp
je 0x1002ba4e
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 8]
cmp eax, ebp
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
je 0x1002ba6c
push 0x493e0
push eax
call ebx
mov eax, dword [esi + 8]
push eax
call edi
mov dword [esi + 8], ebp
mov eax, dword [esi + 0x30]
cmp eax, ebp
je 0x1002ba84
push 0x927c0
push eax
call ebx
mov ecx, dword [esi + 0x30]
push ecx
call edi
mov dword [esi + 0x30], ebp
pop edi
pop esi
pop ebp
pop ebx
jmp dword [sym.imp.ole32.dll_CoUninitialize]
Function at 0x1002c6f0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0
mov esi, ecx
push esi
push 0x1002c570
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x30], eax
pop esi
pop ecx
ret

Function at 0x1002d200
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x19c
mov eax, dword [0x1006099c]
push esi
mov dword [esp + 0x19c], eax
push 0
mov esi, ecx
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, esi
call fcn.1002cb70
lea eax, [esp + 0xc]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edx, dword [esp + 4]
push edx
call fcn.1003fc3f
mov ecx, dword [esp + 0x1a0]
add esp, 4
pop esi
call fcn.1003fd01
add esp, 0x19c
ret
Function at 0x1002dbde
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x1006099c]
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x228], esi
mov ecx, 0x88
lea edi, [ebp - 0x224]
push 8
rep stosd dword es:[edi], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x1002dc1d
xor eax, eax
jmp 0x1002dc6f
lea eax, [ebp - 0x228]
push eax
push edi
mov dword [ebp - 0x228], 0x224
call sub.KERNEL32.dll_Module32First
jmp 0x1002dc4e
mov eax, dword [ebp - 0x224]
cmp eax, dword [ebp + 0xc]
lea eax, [ebp - 0x228]
je 0x1002dc54
push eax
push edi
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x1002dc36
jmp 0x1002dc66
push dword [ebp + 0x14]
push eax
push dword [ebp + 0x10]
call fcn.10041930
xor esi, esi
add esp, 0xc
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.1003fd01
leave
ret 0x10
Function at 0x10030321
Capabilities:
Enumerate processes

Disassembly:
mov eax, 0x100519bd
call fcn.10041c70
sub esp, 0x3bc
mov eax, dword [0x1006099c]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], eax
push edi
mov esi, ecx
mov dword [ebp - 0x364], ebx
mov dword [ebp - 0x370], ebx
mov dword [ebp - 0x36c], ebx
mov dword [ebp - 0x368], ebx
push 0x49
pop ecx
push ebx
xor eax, eax
mov dword [ebp - 0x138], ebx
lea edi, [ebp - 0x134]
push 2
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [ebp - 0x364], eax
je 0x100304a9
lea ecx, [ebp - 0x138]
push ecx
push eax
mov dword [ebp - 0x138], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1003049d
mov ecx, esi
call fcn.1002db7d
mov byte [ebp - 0x35d], al
xor eax, eax
cmp byte [ebp - 0x35d], bl
mov ecx, 0x88
lea edi, [ebp - 0x358]
mov dword [ebp - 0x35c], ebx
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x128]
mov eax, edi
jne 0x100303d9
lea eax, [edi + 1]
push 0x224
lea ecx, [ebp - 0x35c]
push ecx
push eax
push dword [ebp - 0x130]
mov ecx, esi
call fcn.1002dbde
test eax, eax
je 0x10030483
cmp byte [ebp + 0xc], bl
lea eax, [ebp - 0x33c]
push eax
jne 0x10030451
lea ecx, [ebp - 0x390]
call fcn.10002290
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x3c8]
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.1002ff6f
push eax
lea ecx, [ebp - 0x374]
mov byte [ebp - 4], 2
call fcn.10004480
push ebx
push 1
lea ecx, [ebp - 0x3c8]
call fcn.10001640
lea ecx, [ebp - 0x390]
jmp 0x10030478
lea ecx, [ebp - 0x3ac]
call fcn.10002290
lea eax, [ebp - 0x3ac]
push eax
lea ecx, [ebp - 0x374]
mov byte [ebp - 4], 3
call fcn.10004480
lea ecx, [ebp - 0x3ac]
push ebx
push 1
mov byte [ebp - 4], bl
call fcn.10001640
lea eax, [ebp - 0x138]
push eax
push dword [ebp - 0x364]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x100303b1
push dword [ebp - 0x364]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x374]
push eax
call fcn.10003c90
lea ecx, [ebp - 0x374]
call fcn.100034e0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.1003fd01
leave
ret 8

Function at 0x10030a13
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x10030a56
cmp byte [edi], 0
je 0x10030a56
push ebx
push edi
call fcn.100418a0
pop ecx
xor ecx, ecx
cmp dword [esp + 0x10], ecx
mov ebx, eax
jle 0x10030a51
push esi
mov eax, dword [esp + 0x10]
lea esi, [ecx + eax]
mov eax, ecx
cdq
idiv ebx
mov al, byte [esi]
sub al, cl
xor al, byte [edx + edi]
inc ecx
cmp ecx, dword [esp + 0x14]
mov byte [esi], al
jl 0x10030a34
pop esi
mov al, 1
pop ebx
jmp 0x10030a58
xor al, al
pop edi
ret 0xc

Function at 0x10030b21
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x58], eax
ret
Function at 0x100357d8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x1006099c]
push ebx
push esi
push edi
push dword [ebp + 8]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], eax
call fcn.10002290
push 0x10
pop ecx
push 0x44
pop esi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x74], ebx
lea edi, [ebp - 0x70]
push esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x74]
push ebx
push eax
call fcn.10041db0
push 0x10
lea eax, [ebp - 0x30]
push ebx
push eax
mov dword [ebp - 0x74], esi
call fcn.10041db0
mov eax, dword [ebp - 0x1c]
add esp, 0x18
cmp dword [ebp - 8], 0x10
jae 0x1003582f
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x74]
push ecx
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x10035853
cmp byte [ebp + 0xc], bl
jne 0x10035853
xor esi, esi
jmp 0x10035856
mov esi, dword [ebp - 0x30]
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.10001640
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.1003fd01
leave
ret 8

Function at 0x10037e60
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
or esi, 8
xor eax, eax
cmp esi, 1
je 0x10037e96
push edi
mov edx, esi
and edx, 1
shr esi, 1
mov edi, dword [ecx + esi*4]
sub edi, edx
neg edx
xor edi, edx
shr edi, 2
and edi, 0x1ff
add eax, dword [edi*4 + 0x100a3238]
cmp esi, 1
jne 0x10037e70
pop edi
pop esi
ret 4

Function at 0x100380b0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], ecx
xor eax, eax
mov esi, 1
mov ebx, 4
lea esp, [esp]
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx + esi*4]
mov edx, edi
and edx, 1
sub ecx, edx
mov ebp, edx
neg ebp
xor ecx, ebp
shr ecx, 2
and ecx, 0x1ff
mov ebp, dword [ecx*4 + 0x100a3238]
add esi, esi
shr edi, 1
add eax, ebp
or esi, edx
dec ebx
jne 0x100380d0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x100381c0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
test edi, edi
mov edx, 1
je 0x10038209
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov ebx, dword [ebx + edx*4]
mov ecx, esi
and ecx, 1
sub ebx, ecx
mov ebp, ecx
neg ebp
xor ebx, ebp
shr ebx, 2
and ebx, 0x1ff
mov ebp, dword [ebx*4 + 0x100a3238]
add edx, edx
shr esi, 1
add eax, ebp
or edx, ecx
dec edi
jne 0x100381d7
pop esi
pop ebp
pop ebx
pop edi
ret
Function at 0x10039a50
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov eax, ecx
mov cl, byte [esp + 0x10]
push esi
xor ebp, ebp
test cl, cl
push edi
mov dword [esp + 0x10], eax
mov edi, 1
mov ebx, 8
je 0x10039ad8
movzx ecx, byte [esp + 0x20]
mov dword [esp + 0x18], ecx
jmp 0x10039a80
movzx esi, byte [esp + 0x1c]
mov edx, dword [esp + 0x18]
dec ebx
movzx ecx, bl
shr esi, cl
shr edx, cl
and esi, 1
mov ecx, esi
shl ecx, 8
add ecx, edi
mov eax, dword [eax + ecx*4 + 0x400]
and edx, 1
sub eax, edx
mov ecx, edx
neg ecx
xor eax, ecx
shr eax, 2
and eax, 0x1ff
mov ecx, dword [eax*4 + 0x100a3238]
add edi, edi
add ebp, ecx
or edi, edx
cmp esi, edx
jne 0x10039ad0
test ebx, ebx
je 0x10039b10
mov eax, dword [esp + 0x10]
jmp 0x10039a80
test ebx, ebx
je 0x10039b10
mov eax, dword [esp + 0x10]
movzx edx, byte [esp + 0x20]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x18]
dec ebx
mov cl, bl
shr edx, cl
mov ecx, dword [eax + edi*4]
add edi, edi
and edx, 1
sub ecx, edx
mov esi, edx
neg esi
xor ecx, esi
shr ecx, 2
and ecx, 0x1ff
add ebp, dword [ecx*4 + 0x100a3238]
or edi, edx
test ebx, ebx
jne 0x10039ae1
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x10039d00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [esp + 0x20]
mov ecx, eax
shr ecx, 2
mov edx, dword [ecx*4 + 0x100a3238]
mov ecx, 0x800
sub ecx, eax
shr ecx, 2
mov eax, dword [ecx*4 + 0x100a3238]
mov ecx, dword [edi + 4]
mov dword [esp + 0x10], edx
mov edx, ecx
shr edx, 2
mov ebp, dword [edx*4 + 0x100a3238]
mov edx, 0x800
sub edx, ecx
shr edx, 2
mov ecx, dword [edx*4 + 0x100a3238]
add ebp, eax
add ecx, eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ecx
xor esi, esi
mov edi, edi
cmp esi, dword [esp + 0x24]
jae 0x10039e54
mov eax, ebx
shl eax, 5
push esi
lea ecx, [eax + edi + 8]
call fcn.10037e60
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
add eax, edx
mov dword [ecx + esi*4], eax
inc esi
cmp esi, 8
jb 0x10039d60
cmp esi, 0x10
jae 0x10039dfc
lea ecx, [esi - 8]
mov dword [esp + 0x20], ecx
jmp 0x10039da0
cmp esi, dword [esp + 0x24]
jae 0x10039e54
or ecx, 8
xor edx, edx
cmp ecx, 1
je 0x10039de4
mov eax, ecx
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebx*8]
mov ebp, dword [edi + ebp*4 + 0x208]
sub ebp, eax
neg eax
xor ebp, eax
shr ebp, 2
and ebp, 0x1ff
add edx, dword [ebp*4 + 0x100a3238]
cmp ecx, 1
jne 0x10039db4
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
add edx, ebp
mov dword [eax + esi*4], edx
inc esi
inc ecx
cmp esi, 0x10
mov dword [esp + 0x20], ecx
jb 0x10039da0
cmp esi, dword [esp + 0x24]
jae 0x10039e54
lea ebx, [esi - 0x10]
mov ecx, ebx
or ecx, 0x100
xor edx, edx
cmp ecx, 1
je 0x10039e3d
mov eax, ecx
and eax, 1
shr ecx, 1
mov ebp, dword [edi + ecx*4 + 0x408]
sub ebp, eax
neg eax
xor ebp, eax
shr ebp, 2
and ebp, 0x1ff
add edx, dword [ebp*4 + 0x100a3238]
cmp ecx, 1
jne 0x10039e14
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
add edx, ecx
mov dword [eax + esi*4], edx
mov eax, dword [esp + 0x24]
inc esi
inc ebx
cmp esi, eax
jb 0x10039e05
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x1003a750
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x20c
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov esi, 4
cmp esi, 0x800
jae 0x1003a772
movzx edx, byte [esi + 0x100a2a30]
jmp 0x1003a79a
cmp esi, 0x200000
jae 0x1003a78b
mov eax, esi
shr eax, 0xa
movzx edx, byte [eax + 0x100a2a30]
add edx, 0x14
jmp 0x1003a79a
mov ecx, esi
shr ecx, 0x14
movzx edx, byte [ecx + 0x100a2a30]
add edx, 0x28
mov ecx, edx
mov eax, edx
and eax, 1
shr ecx, 1
dec ecx
or eax, 2
shl eax, cl
mov edi, esi
sub edi, eax
push edi
sub eax, edx
push ecx
lea edx, [ebx + eax*4 + 0x28b2c]
push edx
call fcn.100381c0
add esp, 0xc
mov dword [esp + esi*4 + 0x1c], eax
inc esi
cmp esi, 0x80
jb 0x1003a761
lea ebp, [esp + 0x1c]
sub ebp, ebx
lea edx, [ebx + 0x3329c]
sub ebp, 0x33294
lea esi, [ebx + 0x32e94]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 4
jmp 0x1003a800
mov edx, dword [esp + 0x10]
lea esp, [esp]
mov eax, dword [ebx + 0x33ad8]
xor edi, edi
test eax, eax
jbe 0x1003a85f
lea esp, [esp]
mov ecx, edi
or ecx, 0x40
xor edx, edx
cmp ecx, 1
je 0x1003a84d
lea esp, [esp]
mov eax, ecx
and eax, 1
shr ecx, 1
mov ebp, dword [esi + ecx*4 - 0xa764]
sub ebp, eax
neg eax
xor ebp, eax
shr ebp, 2
and ebp, 0x1ff
add edx, dword [ebp*4 + 0x100a3238]
cmp ecx, 1
jne 0x1003a820
mov ebp, dword [esp + 0x14]
mov dword [esi + edi*4], edx
mov eax, dword [ebx + 0x33ad8]
inc edi
cmp edi, eax
jb 0x1003a810
mov edx, dword [esp + 0x10]
mov ecx, dword [ebx + 0x33ad8]
mov eax, 0xe
cmp ecx, eax
jbe 0x1003a88d
mov edi, edi
mov edi, dword [esi + eax*4]
mov ecx, eax
shr ecx, 1
sub ecx, 5
shl ecx, 6
add edi, ecx
mov dword [esi + eax*4], edi
mov ecx, dword [ebx + 0x33ad8]
inc eax
cmp eax, ecx
jb 0x1003a870
mov eax, dword [esi]
mov dword [edx - 8], eax
mov ecx, dword [esi + 4]
mov dword [edx - 4], ecx
mov eax, dword [esi + 8]
mov dword [edx], eax
mov ecx, dword [esi + 0xc]
mov dword [edx + 4], ecx
mov eax, 4
add edx, 8
jmp 0x1003a8b0
cmp eax, 0x800
jae 0x1003a8c0
movzx ecx, byte [eax + 0x100a2a30]
jmp 0x1003a8e5
cmp eax, 0x200000
mov ecx, eax
jae 0x1003a8d8
shr ecx, 0xa
movzx ecx, byte [ecx + 0x100a2a30]
add ecx, 0x14
jmp 0x1003a8e5
shr ecx, 0x14
movzx ecx, byte [ecx + 0x100a2a30]
add ecx, 0x28
mov ecx, dword [esi + ecx*4]
add ecx, dword [edx + ebp]
mov dword [edx], ecx
inc eax
add edx, 4
cmp eax, 0x80
jb 0x1003a8b0
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
sub ebp, 0x200
add ecx, 0x200
add esi, 0x100
dec eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
jne 0x1003a7f8
pop edi
pop esi
pop ebp
mov dword [ebx + 0x33af8], 0
pop ebx
add esp, 0x20c
ret
Function at 0x1003ec25
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x1006099c]
push esi
mov dword [ebp + 0x74], eax
mov esi, ecx
call fcn.1003ebf5
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.10041db0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x1003ec87
cmp dword [ebp - 0x1c], 5
jb 0x1003ec9f
jmp 0x1003ec9b
cmp dword [ebp - 0x10], 1
jne 0x1003ec9f
cmp dword [ebp - 0x1c], 4
ja 0x1003ec9b
jne 0x1003ec9f
cmp dword [ebp - 0x18], 0
jbe 0x1003ec9f
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x710
mov dword [esi + 0x14], 0x100555d8
call fcn.100010e0
test eax, eax
jge 0x1003ecc0
mov byte [0x10061884], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
pop esi
call fcn.1003fd01
add ebp, 0x78
leave
ret
Function at 0x10040e96
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10040eb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1004423d
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x10040ed9
test byte [esp + 8], 2
je 0x10040ed9
call fcn.1004422b
mov dword [eax], 0xd
call fcn.10044234
mov dword [eax], 5
jmp 0x10040eb2
xor eax, eax
ret

Function at 0x100411dd
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.10040d00
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10041278
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x100a42f0]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x10041278
cmp eax, 1
je 0x10041299
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10041278
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x10041245
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x10041274
xor eax, eax
inc eax
jmp 0x100412b8
cmp edi, eax
jae 0x1004127c
xor eax, eax
jmp 0x100412b8
cmp eax, esi
jae 0x10041283
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x100a42f0]
jmp 0x1004129c
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100414b2
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x100415a2
mov eax, 0x94
call fcn.10040d00
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10041617
mov ecx, dword [esi + 0x10]
mov dword [0x100a42f0], ecx
mov eax, dword [esi + 4]
mov dword [0x100a42fc], eax
mov edx, dword [esi + 8]
mov dword [0x100a4300], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x100a42f4], esi
je 0x1004151d
or esi, 0x8000
mov dword [0x100a42f4], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x100a42f8], eax
call fcn.10044e8f
test eax, eax
pop ecx
je 0x10041617
call fcn.10044a39
test eax, eax
jne 0x1004154a
call fcn.10044ee0
jmp 0x10041617
call fcn.10049233
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x100a5964], eax
call fcn.10049111
mov dword [0x100a4100], eax
call fcn.10048bf2
test eax, eax
jl 0x1004159b
call fcn.1004906f
test eax, eax
jl 0x10041596
call fcn.10048e3c
test eax, eax
jl 0x10041596
push 0
call fcn.10046a8a
test eax, eax
pop ecx
jne 0x10041596
inc dword [0x100a40fc]
jmp 0x10041628
call fcn.10048df0
call fcn.10044822
jmp 0x10041540
test eax, eax
jne 0x100415d2
cmp dword [0x100a40fc], eax
jle 0x10041617
dec dword [0x100a40fc]
cmp dword [0x100a432c], eax
jne 0x100415c1
call fcn.10046bc8
call fcn.10048df0
call fcn.10044822
call fcn.10044ee0
jmp 0x10041628
cmp eax, 2
jne 0x1004161b
push 0x8c
push 1
call fcn.10048b37
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10041617
push esi
push dword [0x100611f0]
call dword [fcn.100a4290]
test eax, eax
push esi
je 0x10041611
call fcn.1004483f
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x10041628
call fcn.1003fa31
pop ecx
xor eax, eax
jmp 0x1004162b
cmp eax, 3
jne 0x10041628
push 0
call fcn.10044a0a
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc