joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e5ee
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x1001e65b
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001e64f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
jge 0x1001e641
mov dword [ebp - 4], 1
jmp 0x1001e645
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x1001e659
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x1001e693
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
push 0
push dword [ebp - 0x24]
push 0x21ee
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push 0x600
push dword [ebp - 0x30]
call fcn.10010133
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x1001eb30
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001ebb7
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001eba4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001eb88
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001eba2
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.1000b0e1
and dword [eax], 0
jmp 0x1001eb7d
jmp 0x1001ebb2
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
jmp 0x1001ec41
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1001ebf9
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1001ebf7
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x1001ec41
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1001ec27
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x1001ec41
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.1000b0e1
and dword [eax], 0
jmp 0x1001ec1c
mov esp, ebp
pop ebp
ret
Function at 0x1001ec45
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001ecc5
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001ec7b
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
jmp 0x1001ecc3
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1001eca9
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x1001ecc3
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.1000b0e1
and dword [eax], 0
jmp 0x1001ec9e
jmp 0x1001ed1d
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1001ecf5
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001ecf3
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
jmp 0x1001ed1d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1001ed1d
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esp, ebp
pop ebp
ret
Function at 0x1002290a
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002294b
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push 0x5109
push 0xa13
push 0x6302
push 0x315d
push 1
push 0x2704
push dword [ebp - 8]
push 0x87f
call fcn.100229c8
add esp, 0x20
jmp 0x100229c4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10022979
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x100229c4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100229a7
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x100229c4
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.1000b0e1
mov dword [eax], 0x21f1eb32
jmp 0x1002299c
mov esp, ebp
pop ebp
ret
Function at 0x100266cd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10026763
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10026716
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10026714
push 0x1663
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x10026761
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10026744
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x10026761
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.1000b0e1
mov dword [eax], 0xfffffffa
jmp 0x10026739
jmp 0x10026784
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0x2975
push 0
call fcn.10026a15
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x100405d5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a660
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100406dc
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x100406c3
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
push 0
mov ecx, dword [ebp - 0x14]
call fcn.1000b0e1
mov dword [eax], 0x1b
jmp 0x1004064c
push 0
mov ecx, dword [ebp - 0x14]
call fcn.1000b0e1
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
push 0
mov ecx, dword [ebp - 0x14]
call fcn.1000b0e1
cmp dword [eax], 0xffffffed
jl 0x100406c1
mov dword [ebp - 0x1c], 0x358bd4df
mov dword [ebp - 0x28], 0x82d564c7
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], eax
push 1
mov ecx, dword [ebp - 0x14]
call fcn.1000b0e1
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, 0xffff
sub eax, dword [ebp - 0x1c]
je 0x10040698
mov dword [ebp - 0x38], 1
jmp 0x1004069c
and dword [ebp - 0x38], 0
cmp dword [ebp - 0x28], 1
jne 0x100406ab
mov dword [ebp - 0x3c], 1
jmp 0x100406af
and dword [ebp - 0x3c], 0
mov dword [ebp - 0x24], 0x609b2b53
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
jmp 0x10040634
jmp 0x100406d7
mov byte [ebp - 0xd], 0
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x100406d7
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
jmp 0x10040796
lea eax, [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x10040707
mov byte [ebp - 0xe], 0
movzx eax, byte [ebp - 0xe]
test eax, eax
je 0x10040702
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x10040796
mov dword [ebp - 0x48], 9
push 2
lea ecx, [ebp - 0x5c]
call fcn.1000b069
and dword [ebp - 4], 0
mov dword [ebp - 0x4c], 2
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x18], 0
jmp 0x1004073a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10040753
push dword [ebp - 0x18]
lea ecx, [ebp - 0x5c]
call fcn.1000b0e1
mov dword [eax], 0x277ebd00
jmp 0x10040733
push 0
lea eax, [ebp - 0x5c]
push eax
push 1
push 1
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.1003ea91
add esp, 0x1c
push 0xa94
push 0
push 0x38e
push 0x10c0
call fcn.10043f9a
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.1000b0c5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10041cf9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10041d7f
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10041d32
push 0
push 0x3f0
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x10041d7d
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10041d60
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10041d7d
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000b0e1
mov dword [eax], 0xfffffffe
jmp 0x10041d55
jmp 0x10041dd7
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10041daf
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10041dd7
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
shr eax, 1
push eax
mov ecx, dword [ebp - 0x38]
call fcn.1003af0b
mov esp, ebp
pop ebp
ret
Function at 0x10041dfd
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a6bd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10041f77
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10041f68
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], 0x5dde
mov dword [ebp - 0x34], 0x10008d38
cmp dword [ebp - 0x20], 0x6188
jle 0x10041ef0
push 0
push 0x146b
push 0x23dc
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
and dword [ebp - 0x14], 0
jmp 0x10041e93
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x290a
jge 0x10041ef0
and dword [ebp - 0x18], 0
jmp 0x10041ea9
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x520
jge 0x10041eee
and dword [ebp - 0x1c], 0
jmp 0x10041ebf
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6eb1
jge 0x10041eec
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sar eax, cl
or eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], edx
push dword [ebp - 0x64]
push dword [ebp - 0x68]
mov ecx, 0x106112b8
call fcn.1000af54
jmp 0x10041eb8
jmp 0x10041ea2
jmp 0x10041e8c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x5b4c
jge 0x10041f10
mov edx, dword [ebp - 0x34]
mov ecx, 0x106112b8
call fcn.1000c9c4
jmp 0x10041f2c
or dword [ebp - 4], 0xffffffff
jmp 0x10041f36
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x48]
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x50]
call fcn.1004477c
mov ecx, eax
call fcn.100443c4
jmp 0x10041f75
push 0x1663
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x10041fc9
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x58], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x10041fbe
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
movzx eax, byte [eax]
test eax, eax
je 0x10041fbc
push 0x6ad9
push 0
push 0x4036
push 0x6d7e
call fcn.10041ddb
add esp, 0x10
jmp 0x10041fc9
push 0x378
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004875b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100487cf
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100487b4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov eax, dword [eax + 4]
sub eax, dword [ecx]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov dword [ecx + 4], eax
jmp 0x100487cd
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100487cd
push 0x1663
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x100487ec
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
push 1
push dword [ebp - 0x24]
push 0x1141
push 0x655f
call fcn.10046a2d
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1004aed2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10069897
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x40], 0
je 0x1004aff6
cmp byte [ebx + 0x45], 0
je 0x1004aff6
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x1004af1c
xor al, al
jmp 0x1004aff8
xor eax, eax
mov dword [esp + 0x24], 0xf
push eax
push 8
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], eax
mov byte [esp + 0x18], al
call fcn.1000c723
and dword [esp + 0x34], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
cmp ecx, 0x10
lea eax, [esp + 0xc]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x10]
push eax
mov eax, dword [esp + 0x24]
lea esi, [esp + 0x14]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1004af81
dec eax
je 0x1004af85
dec eax
dec eax
je 0x1004afe3
xor bl, bl
jmp 0x1004afe5
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
mov edx, dword [esp + 0x10]
cmp ecx, 0x10
mov esi, dword [esp + 0xc]
cmovae eax, edx
sub esi, eax
je 0x1004afc4
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x14]
push esi
cmovae eax, edx
push 1
push eax
call fcn.1005233d
add esp, 0x10
cmp esi, eax
jne 0x1004af7d
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
cmp byte [ebx + 0x45], 0
je 0x1004afe3
test esi, esi
jne 0x1004af47
push esi
push 8
lea ecx, [esp + 0x18]
call fcn.100399aa
jmp 0x1004af3f
mov bl, 1
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.1000b3b8
mov al, bl
jmp 0x1004aff8
mov al, 1
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10065885
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006e740]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10054ce8
mov dword [ebp - 0x14], eax
cmp dword [0x106123c8], esi
jne 0x10065978
push 0x800
push esi
push 0x100076a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10065905
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10065a58
push esi
push esi
push 0x100076a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10065a58
push 0x100076b8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10065a58
push eax
call ebx
push 0x100076c4
push edi
mov dword [0x106123c8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100076d4
push edi
mov dword [0x106123cc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100076e8
push edi
mov dword [0x106123d0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106123d8], eax
test eax, eax
je 0x10065975
push 0x10007704
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106123d4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006599d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10065990
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x100659b2
push 4
pop eax
jmp 0x10065a5a
cmp dword [ebp - 0x14], esi
je 0x100659b2
push dword [0x106123c8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10065997
mov eax, dword [0x106123d4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10065a10
cmp dword [0x106123d8], edi
je 0x10065a10
push eax
call ebx
push dword [0x106123d8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10065a10
test eax, eax
je 0x10065a10
call ecx
test eax, eax
je 0x10065a05
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10065a05
test byte [ebp - 8], 1
jne 0x10065a10
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10065a40
mov eax, dword [0x106123cc]
cmp eax, edi
je 0x10065a3d
push eax
call ebx
test eax, eax
je 0x10065a3d
call eax
mov esi, eax
test esi, esi
je 0x10065a3d
mov eax, dword [0x106123d0]
cmp eax, edi
je 0x10065a3d
push eax
call ebx
test eax, eax
je 0x10065a3d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x106123c8]
call ebx
test eax, eax
je 0x10065a58
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10065a5a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10052c37
mov esp, ebp
pop ebp
ret