joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000474e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push ebx
push esi
push edi
xor eax, eax
xor esi, esi
push 0x208
mov word [ebp - 0x230], ax
mov ebx, edx
lea eax, [ebp - 0x22e]
mov dword [ebp - 8], ebx
mov edi, ecx
mov dword [ebp - 4], esi
push esi
push eax
mov dword [ebp - 0x20], edi
call sub.ntdll.dll_memset
add esp, 0xc
push 4
pop eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
push eax
push 0x20119
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10004868
lea eax, [ebp - 0x24]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xc]
push eax
push esi
push str.CurrentMajorVersionNumber
push dword [ebp - 4]
call edi
test eax, eax
jne 0x100047f4
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x1c]
push eax
push esi
push str.CurrentMinorVersionNumber
push dword [ebp - 4]
call edi
test eax, eax
jne 0x100047f4
cmp dword [ebp - 0xc], 4
jne 0x100047f4
cmp dword [ebp - 0x1c], 4
je 0x10004865
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x20a
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push str.CurrentVersion
push dword [ebp - 4]
call edi
test eax, eax
jne 0x10004868
cmp dword [ebp - 0x18], 1
jne 0x10004868
lea eax, [ebp - 0x230]
push 0x2e
push eax
call dword [sym.imp.ntdll.dll_wcschr]
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1000483b
xor eax, eax
mov word [edi], ax
mov ebx, dword [sym.imp.ntdll.dll__wtoi]
lea eax, [ebp - 0x230]
push eax
call ebx
pop ecx
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
mov dword [eax], esi
test edi, edi
je 0x10004865
lea eax, [edi + 2]
push eax
call ebx
pop ecx
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
xor esi, esi
inc esi
cmp dword [ebp - 4], 0
je 0x10004877
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100049d0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push str.LocalFC6B2E80_03FF_4415_B850_5FA94D62AE61
xor ebx, ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x100049f1
xor al, al
jmp 0x10004a44
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str.LocalFC6B2E80_03FF_4415_B850_5FA94D62AE62
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
test esi, esi
je 0x10004a3b
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10004a2f
cmp eax, 0x80
je 0x10004a2f
push esi
call edi
jmp 0x10004a3b
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call edi
mov bl, 1
push dword [ebp - 4]
call edi
pop edi
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004a49
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
push esi
xor esi, esi
mov dword [esp + 0x18], 0x67452301
push edx
mov edx, ecx
mov dword [esp + 0x18], esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], 0xefcdab89
mov dword [esp + 0x24], 0x98badcfe
mov dword [esp + 0x28], 0x10325476
call fcn.100032f0
pop ecx
mov edx, esi
mov eax, edx
mov ecx, edx
sar eax, 2
and ecx, 3
shl ecx, 3
mov eax, dword [esp + eax*4 + 0x10]
shr eax, cl
mov byte [esp + edx + 8], al
inc edx
cmp edx, 8
jl 0x10004a8c
mov eax, dword [esp + 0x10]
mov edx, 0x10006df0
push 0xfffffffffffffff7
shr eax, 3
pop ecx
sub ecx, eax
and ecx, 0x3f
inc ecx
push ecx
lea ecx, [esp + 0x14]
call fcn.100032f0
push 8
lea edx, [esp + 0x10]
lea ecx, [esp + 0x18]
call fcn.100032f0
mov edx, dword [ebp + 8]
pop ecx
pop ecx
mov eax, esi
mov ecx, esi
sar eax, 2
and ecx, 3
shl ecx, 3
mov eax, dword [esp + eax*4 + 0x18]
shr eax, cl
mov byte [esi + edx], al
inc esi
cmp esi, 0x10
jl 0x10004adc
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10004b6b
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], ecx
push 3
xor edx, edx
pop ecx
lea eax, [esi + 2]
div ecx
mov edi, eax
mov eax, dword [ebp + 0xc]
shl edi, 2
mov dword [ebp - 8], edi
cmp dword [eax], edi
jae 0x10004b97
xor al, al
jmp 0x10004c53
xor edx, edx
mov dword [eax], edi
test esi, esi
je 0x10004c33
mov edi, dword [ebp - 4]
push ebx
mov ebx, dword [ebp + 8]
cmp edx, esi
jae 0x10004bb4
mov cl, byte [edx + edi]
inc edx
jmp 0x10004bb6
xor cl, cl
cmp edx, esi
jae 0x10004bc0
mov ah, byte [edx + edi]
inc edx
jmp 0x10004bc2
xor ah, ah
cmp edx, esi
jae 0x10004bcf
mov al, byte [edx + edi]
inc edx
mov byte [ebp + 0xf], al
jmp 0x10004bd3
mov byte [ebp + 0xf], 0
movzx eax, ah
movzx ecx, cl
shl ecx, 8
add ecx, eax
movzx eax, byte [ebp + 0xf]
shl ecx, 8
add ecx, eax
mov eax, ecx
shr eax, 0x12
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + 1], al
mov eax, ecx
shr eax, 6
and ecx, 0x3f
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + 2], al
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx + 3], al
add ebx, 4
cmp edx, esi
jb 0x10004bae
mov edi, dword [ebp - 8]
push 3
pop ecx
pop ebx
xor edx, edx
mov eax, esi
div ecx
mov ecx, dword [edx*4 + 0x10006e70]
test ecx, ecx
jle 0x10004c51
mov eax, dword [ebp + 8]
dec eax
add eax, edi
mov byte [eax], 0x3d
dec eax
dec ecx
jne 0x10004c4a
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10004d19
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, edx
xor esi, esi
test edi, edi
je 0x10004d3d
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
mov eax, esi
div dword [ebp + 0xc]
mov al, byte [edx + ebx]
xor byte [esi + ecx], al
inc esi
cmp esi, edi
jb 0x10004d2a
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x10004dcf
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
push edi
push 0x40
xor edi, edi
lea eax, [ebp - 0x54]
xorps xmm0, xmm0
mov esi, ecx
push edi
push eax
movdqu xmmword [ebp - 0x10], xmm0
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x58], 0x44
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10004e22
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor al, al
jmp 0x10004e35
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10004e3b
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
mov word [ebp - 0xc], 0x500
lea eax, [ebp - 4]
mov dword [ebp - 8], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10004e82
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
cmp dword [ebp - 4], 0
pop ebx
je 0x10004e92
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
xor eax, eax
cmp dword [ebp - 8], eax
setne al
mov esp, ebp
pop ebp
ret

Function at 0x10004e9e
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 4], ecx
push esi
push 2
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10004ec5
xor eax, eax
jmp 0x10004f28
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x10004f1b
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10004f0d
cmp dword [ebp - 0x228], ebx
jbe 0x10004f0d
test esi, esi
je 0x10004f07
cmp dword [ebp - 0x228], esi
jae 0x10004f0d
mov esi, dword [ebp - 0x228]
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10004edf
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004f2f
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov dword [ebp - 4], eax
mov ecx, ebx
call fcn.10004e9e
mov edi, eax
test edi, edi
je 0x10004fb7
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, 0x4e20
ja 0x10004fb0
test esi, esi
je 0x10004f73
push esi
call ebx
push edi
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10004fa0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x10004fa0
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 8]
mov edx, edi
call fcn.10004e9e
mov edi, eax
test edi, edi
jne 0x10004f5c
test esi, esi
je 0x10004fb7
push esi
call ebx
xor eax, eax
test edi, edi
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10004fce
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 0x618
push esi
test ecx, ecx
jne 0x10005038
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall9563BC59_9556_4805_8CD4_886781779D8D
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x10005008
xor al, al
jmp 0x100050fa
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x628]
push eax
push ebx
push ebx
push str.Parameters
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10005001
lea ecx, [ebp - 0x628]
push edi
lea eax, [ebp - 8]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
jne 0x10005051
xor al, al
jmp 0x100050f9
cmp dword [ebp - 8], 8
jl 0x100050f0
mov ebx, dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x104
push dword [edi]
push ebx
call esi
push 0x104
push dword [edi + 4]
lea eax, [ebx + 0x208]
push eax
call esi
push 0x104
push dword [edi + 8]
lea eax, [ebx + 0x410]
push eax
call esi
push 0x104
push dword [edi + 0xc]
lea eax, [ebx + 0x618]
push eax
call esi
push 0x104
push dword [edi + 0x10]
lea eax, [ebx + 0x820]
push eax
call esi
push 0x104
push dword [edi + 0x14]
lea eax, [ebx + 0xa28]
push eax
call esi
push 0x10007a80
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
neg eax
push 0x104
sbb eax, eax
neg eax
mov dword [ebx + 0xc30], eax
lea eax, [ebx + 0xc34]
push dword [edi + 0x1c]
push eax
call esi
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005157
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ecx, ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push str.SoftwareCLASSESCLSID9563BC59_9556_4805_8CD4_886781779D8D
push SysReAllocString
mov bl, cl
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100051ec
cmp dword [ebp - 8], 2
push dword [ebp - 4]
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x100051a4
push str.SoftwareCLASSESCLSID9563BC59_9556_4805_8CD4_886781779D8D
jmp 0x100051e1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push 0xf003f
push eax
push eax
push eax
push str.SoftwareCLASSESCLSID9563BC59_9556_4805_8CD4_886781779D8DInprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, 0x3fd
sete bl
test eax, eax
jne 0x100051ec
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SoftwareCLASSESCLSID9563BC59_9556_4805_8CD4_886781779D8DInprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005628
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], ebx
call fcn.100055ab
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x1000564d
xor al, al
jmp 0x100056fc
push edi
mov edi, dword [eax + 0x10]
xor ecx, ecx
add edi, ebx
mov dword [ebp - 4], ecx
cmp cx, word [eax + 0xa]
jae 0x100056f9
push esi
mov edx, ebx
mov ecx, edi
call fcn.100054cf
mov dword [ebp - 0x10], eax
pop ecx
test eax, eax
je 0x10005702
mov esi, dword [edi + 0x2a]
mov edx, ebx
push dword [ebp - 8]
add esi, ebx
mov ecx, esi
call fcn.10005461
pop ecx
test eax, eax
je 0x10005702
xor eax, eax
cmp word [esi + 8], ax
jne 0x10005702
mov edx, dword [esi + 0x12]
cmp edx, dword [esi + 0x16]
jne 0x10005702
test byte [esi + 6], 8
jne 0x10005702
test edx, edx
je 0x100056dd
movzx ebx, word [esi + 0x1c]
movzx eax, word [esi + 0x1a]
add ebx, 0x1e
add ebx, esi
add ebx, eax
or ecx, 0xffffffff
movzx eax, byte [ebx]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10006e80]
inc ebx
dec edx
jne 0x100056ba
mov ebx, dword [ebp - 0xc]
not ecx
mov dword [esi + 0xe], ecx
mov dword [edi + 0x10], ecx
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 4]
add edi, dword [ebp - 0x10]
inc esi
mov dword [ebp - 4], esi
movzx eax, word [eax + 0xa]
cmp esi, eax
mov esi, dword [ebp - 8]
jb 0x10005662
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
jmp 0x100056fb
Function at 0x1001bca
Capabilities:
Get domain controller name
Get domain information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
xor ebx, ebx
push 1
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [edi], ebx
call sub.NETAPI32.dll_DsRoleGetPrimaryDomainInformation
cmp eax, ebx
mov dword [ebp + 0xc], eax
jne 0x1001c5c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 4
je 0x1001c5c
cmp eax, 5
je 0x1001c5c
cmp byte [ebp + 8], bl
push esi
lea eax, [ebp - 4]
push eax
je 0x1001c1b
push 0x1010
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
jmp 0x1001c3c
mov esi, dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
push 0x50
push ebx
push ebx
push ebx
push ebx
call esi
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x1001c43
lea eax, [ebp - 4]
push eax
push 0x10
push ebx
push ebx
push ebx
push ebx
call esi
cmp eax, ebx
mov dword [ebp + 0xc], eax
jne 0x1001c5b
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x1001c5b
mov eax, dword [eax]
cmp eax, ebx
je 0x1001c5b
add eax, 4
push eax
call fcn.01006d6a
mov dword [edi], eax
pop esi
cmp dword [ebp - 8], ebx
je 0x1001c69
push dword [ebp - 8]
call sub.NETAPI32.dll_DsRoleFreeMemory
cmp dword [ebp - 4], ebx
pop edi
pop ebx
je 0x1001c78
push dword [ebp - 4]
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp + 0xc]
leave
ret 8
Function at 0x1001d48
Capabilities:
Write file on windows

Disassembly:
push ebp
mov eax, 0x2018
lea ebp, [esp - 0x1f98]
call fcn.01006c30
mov eax, dword [0x1008134]
mov dword [ebp + 0x1f94], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
cmp dword [ebp + 0x1fa0], eax
jne 0x1001d79
push 0xfffffffffffffff4
jmp 0x1001d7b
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push dword [ebp + 0x1fa8]
mov dword [ebp - 0x70], eax
push dword [ebp + 0x1fa4]
lea eax, [ebp - 0x6c]
push 0x1000
push eax
call dword [sym.imp.msvcrt.dll__vsnwprintf]
lea eax, [ebp - 0x6c]
xor esi, esi
push eax
mov word [ebp + 0x1f92], si
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 0x14
push dword [ebp - 0x70]
mov dword [ebp + 0x1fa0], eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
jne 0x1001df8
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x1001df8
push esi
lea eax, [ebp + 0x1fa0]
push eax
push dword [ebp + 0x1fa0]
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x1001e62
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x6c]
push eax
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
call ebx
push eax
mov dword [ebp - 0x78], eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0x74], eax
je 0x1001e5a
push esi
push esi
push dword [ebp - 0x78]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x6c]
push eax
push esi
call edi
push eax
call ebx
push esi
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0x78]
dec eax
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x74]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x1001e60
mov dword [ebp + 0x1fa0], esi
pop edi
pop ebx
mov ecx, dword [ebp + 0x1f94]
mov eax, dword [ebp + 0x1fa0]
pop esi
call fcn.01006a01
add ebp, 0x1f98
leave
ret
Function at 0x1005f55
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x1008134]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
xor edi, edi
jmp 0x1005fa8
push esi
push 1
lea eax, [ebp - 0x68]
push 1
push eax
call dword [sym.imp.msvcrt.dll_fread]
mov ecx, dword [esi + 0xc]
add esp, 0x10
test cl, 0x20
jne 0x1005fb0
test eax, eax
jne 0x1005f8f
test cl, 0x10
jmp 0x1005fa6
jbe 0x1005fa8
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x68]
push 1
push eax
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
test eax, eax
je 0x1005fb0
test byte [esi + 0xc], 0x10
je 0x1005f6c
jmp 0x1005fb5
mov edi, 0x104
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.01006a01
leave
ret 8

Function at 0x1006a01
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1008134]
jne 0x1006a0a
ret
jmp 0x1006a0f
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x1008134]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x10081cc]
test eax, eax
je 0x1006a33
call eax
cmp dword [0x10081d0], 0
je 0x1006a7a
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x10081d0]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.01006a01
add ebp, 0x2a8
leave
ret
Function at 0x1006a9f
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1001918
call fcn.01006c90
cmp word [0x1000000], 0x5a4d
jne 0x1006ade
mov eax, dword [0x100003c]
cmp dword [eax + 0x1000000], 0x4550
jne 0x1006ade
movzx ecx, word [eax + 0x1000018]
cmp ecx, 0x10b
je 0x1006af7
cmp ecx, 0x20b
je 0x1006ae4
and dword [ebp - 0x1c], 0
jmp 0x1006b0e
cmp dword [eax + 0x1000084], 0xe
jbe 0x1006ade
xor ecx, ecx
cmp dword [eax + 0x10000f8], ecx
jmp 0x1006b08
cmp dword [eax + 0x1000074], 0xe
jbe 0x1006ade
xor ecx, ecx
cmp dword [eax + 0x10000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
and dword [ebp - 4], 0
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x10081d4], 0xffffffff
or dword [0x10081d8], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x10081c8]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x10081c4]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x10081dc], eax
call fcn.01006c8c
cmp dword [0x1008140], 0
jne 0x1006b6b
push fcn.01006c8c
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01006c7a
push 0x1008010
push 0x100800c
call sub.msvcrt.dll__initterm
mov eax, dword [0x10081c0]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x10081bc]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x34], eax
push 0x1008008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___winitenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01002794
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], 0
jne 0x1006be3
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1006c18
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01006ccb
ret