joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468870
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push esi
push eax
call fcn.004689a0
add esp, 8
test eax, eax
jne 0x468889
pop esi
ret
mov eax, dword [esi + 0x8c]
test eax, eax
jne 0x468895
pop esi
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x8c], 0
pop esi
ret

Function at 0x4688b0
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x38c]
mov esi, dword [edi]
push eax
call fcn.00468bb0
add esp, 4
test esi, esi
je 0x46893a
mov edi, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x8c]
test eax, eax
je 0x46892e
cmp dword [esi + 8], 0xffffffff
je 0x46892e
push 0
push eax
call ebp
mov dword [esi + 0x8c], 0
mov ecx, dword [edi + 0xa0]
test ecx, ecx
je 0x46891c
mov eax, dword [esi + 0x1c]
push 0
lea edx, [eax*8]
sub edx, eax
lea eax, [ecx + edx*4]
mov ecx, dword [ecx + edx*4 + 0x14]
mov edx, dword [eax + 0xc]
add ecx, edx
push ecx
jmp 0x468920
push 0
push 0
push esi
push 8
push 0x15
push edi
call fcn.00464520
add esp, 0x18
mov esi, dword [esi + 0x48]
test esi, esi
jne 0x4688d6
mov edi, dword [esp + 0x14]
pop ebp
mov edx, dword [edi + 0x38c]
push edx
call fcn.00468bc0
add esp, 4
pop edi
pop esi
ret

Function at 0x469da0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov edx, eax
dec eax
test edx, edx
je 0x469ddc
push ebx
push esi
lea esi, [eax + 1]
mov eax, dword [esp + 0x14]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, ah
mov ax, word [edx*2 + 0x4c398c]
xor ax, bx
inc ecx
dec esi
jne 0x469db8
pop esi
pop ebx
ret
mov ax, word [esp + 0xc]
ret
Function at 0x46dae0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x46dcb2
xor ecx, ecx
xor edx, edx
mov ch, byte [eax]
mov dl, byte [eax + 2]
mov cl, byte [eax + 1]
push ebx
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 3]
push ebp
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 6]
mov dword [eax], ecx
xor ecx, ecx
push esi
mov ch, byte [eax + 4]
push edi
mov cl, byte [eax + 5]
xor ebp, ebp
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 7]
shl ecx, 8
or ecx, edx
mov edx, dword [esp + 0x18]
mov dword [eax + 4], ecx
xor ecx, ecx
mov ch, byte [eax + 8]
lea edi, [edx + 0xc]
mov cl, byte [eax + 9]
mov word [eax + 8], cx
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov cx, word [eax + 8]
mov word [edx + 8], cx
xor ecx, ecx
movzx si, byte [eax + 0xb]
mov ch, byte [eax + 0xa]
or ecx, esi
mov word [eax + 0xa], cx
mov word [edx + 0xa], cx
movzx si, byte [eax + 0xb]
xor ecx, ecx
mov ch, byte [eax + 0xa]
or ecx, esi
mov esi, dword [eax + 0xc]
mov word [eax + 0xa], cx
and ecx, 0xffff
mov ebx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movzx si, byte [eax + 0x11]
mov bp, word [eax + 0xa]
xor ecx, ecx
mov ch, byte [eax + 0x10]
add ebp, 0xc
or ecx, esi
mov word [eax + 0x10], cx
mov word [edx + ebp], cx
movzx si, byte [eax + 0x11]
xor ecx, ecx
lea edi, [edx + ebp + 2]
mov ch, byte [eax + 0x10]
or ecx, esi
mov esi, dword [eax + 0x14]
mov word [eax + 0x10], cx
and ecx, 0xffff
mov ebx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movzx si, byte [eax + 0x19]
xor ecx, ecx
mov cx, word [eax + 0x10]
lea ebp, [ecx + ebp + 2]
xor ecx, ecx
mov ch, byte [eax + 0x18]
or ecx, esi
lea edi, [edx + ebp + 2]
mov word [eax + 0x18], cx
mov word [edx + ebp], cx
movzx si, byte [eax + 0x19]
xor ecx, ecx
mov ch, byte [eax + 0x18]
or ecx, esi
mov esi, dword [eax + 0x1c]
mov word [eax + 0x18], cx
and ecx, 0xffff
mov ebx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movzx si, byte [eax + 0x21]
xor ecx, ecx
mov cx, word [eax + 0x18]
lea ebp, [ecx + ebp + 2]
xor ecx, ecx
mov ch, byte [eax + 0x20]
or ecx, esi
lea edi, [edx + ebp + 2]
mov word [eax + 0x20], cx
mov word [edx + ebp], cx
movzx si, byte [eax + 0x21]
xor ecx, ecx
mov ch, byte [eax + 0x20]
or ecx, esi
mov esi, dword [eax + 0x24]
mov word [eax + 0x20], cx
and ecx, 0xffff
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dl, byte [eax + 6]
xor ecx, ecx
mov ch, byte [eax + 4]
pop edi
mov cl, byte [eax + 5]
pop esi
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [eax + 7]
pop ebp
shl ecx, 8
or ecx, edx
xor edx, edx
mov dh, byte [eax]
mov dword [eax + 4], ecx
mov dl, byte [eax + 1]
xor ecx, ecx
mov ch, byte [eax + 8]
pop ebx
mov cl, byte [eax + 9]
mov word [eax + 8], cx
xor ecx, ecx
mov cl, byte [eax + 2]
shl edx, 8
or edx, ecx
xor ecx, ecx
mov cl, byte [eax + 3]
shl edx, 8
or edx, ecx
mov dword [eax], edx
ret
Function at 0x470880
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x94
mov eax, dword [esp + 0x9c]
push esi
push 0x40
lea ecx, [esp + 0x1c]
xor esi, esi
push eax
push ecx
mov dword [esp + 0x24], 0x67452301
mov dword [esp + 0x28], 0xefcdab89
mov dword [esp + 0x2c], 0x98badcfe
mov dword [esp + 0x30], 0x10325476
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
call fcn.00470690
lea edx, [esp + 0x24]
lea eax, [esp + 0x10]
push edx
push eax
call fcn.004707c0
mov esi, dword [esp + 0xb0]
add esp, 0x14
xor edx, edx
mov cl, byte [esp + edx + 4]
mov al, cl
and cl, 0xf
sar al, 4
and al, 0xf
cmp al, 0xa
movsx eax, al
jge 0x4708fa
add eax, 0x30
jmp 0x4708fd
add eax, 0x57
mov byte [esi], al
cmp cl, 0xa
movsx eax, cl
jge 0x47090c
add eax, 0x30
jmp 0x47090f
add eax, 0x57
mov byte [esi + 1], al
inc edx
add esi, 2
cmp edx, 0x10
jl 0x4708e0
pop esi
add esp, 0x94
ret

Function at 0x470930
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x90]
push ebp
mov ebp, dword [esp + 0x90]
push esi
push edi
mov ecx, 0x10
xor eax, eax
mov edi, ebp
mov esi, dword [esp + 0xa0]
rep stosd dword es:[edi], eax
mov ecx, 8
mov edi, ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
test esi, esi
mov dword [esp + 0x14], 0x9d14e9a1
mov dword [esp + 0x18], 0x593b6b0e
je 0x4709bb
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x28
jne 0x47099f
mov byte [esi + 0x20], al
mov ecx, 0x20
jmp 0x4709a9
cmp ecx, 0x38
jle 0x4709a9
mov ecx, 0x38
mov eax, ecx
lea edi, [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x4c3e24
test ecx, ecx
je 0x4709ef
mov edi, ecx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x38
jle 0x4709da
mov ecx, 0x38
xor eax, eax
test ecx, ecx
jle 0x4709ef
mov dl, byte [eax + 0x4c3e24]
xor byte [esp + eax + 0x1c], dl
inc eax
cmp eax, ecx
jl 0x4709e0
lea eax, [esp + 0x14]
push eax
push ebp
call fcn.00470880
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.01d0a8e3
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea esi, [edx + ebp]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x10], esi
mov esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
cdq
and edx, 3
and ecx, 3
add eax, edx
rep movsb byte es:[edi], byte [esi]
sar eax, 2
xor ecx, ecx
test eax, eax
jle 0x470a54
mov esi, ebp
mov dl, byte [esi]
add esi, 4
mov byte [ecx + ebx], dl
inc ecx
cmp ecx, eax
jl 0x470a47
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x84
ret
Function at 0x471620
Capabilities:
Encode data using base64
Terminate process

Disassembly:
sub esp, 0x118
mov ecx, 0x3f
mov eax, 0x80808080
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 0x41
mov cl, al
sub cl, 0x41
mov byte [esp + eax + 0x28], cl
inc eax
cmp eax, 0x5a
jle 0x471642
mov eax, 0x61
mov dl, al
sub dl, 0x47
mov byte [esp + eax + 0x28], dl
inc eax
cmp eax, 0x7a
jle 0x471656
mov eax, 0x30
mov cl, al
add cl, 4
mov byte [esp + eax + 0x28], cl
inc eax
cmp eax, 0x39
jle 0x47166a
mov edi, dword [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x53], 0x3e
mov byte [esp + 0x57], 0x3f
mov byte [esp + 0x65], 0
mov dword [esp + 0x18], ebp
je 0x4717fd
mov ebx, dword [esp + 0x130]
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 4
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x12c]
xor eax, eax
lea esi, [edx + ecx]
movsx ecx, byte [esi + eax]
mov dl, byte [esp + ecx + 0x28]
test dl, 0x80
jne 0x4717ce
mov byte [esp + eax + 0x20], cl
mov byte [esp + eax + 0x1c], dl
inc eax
cmp eax, 4
jl 0x4716cc
mov esi, dword [esp + 0x138]
mov edx, dword [esp + 0x10]
cmp edx, dword [esi]
jle 0x471736
mov eax, dword [esp + 0x14]
push eax
call fcn.00474837
mov ecx, dword [esi]
mov esi, ebx
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
mov dword [esp + 0x2c], eax
rep movsb byte es:[edi], byte [esi]
call fcn.0047474e
mov ecx, dword [esp + 0x140]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x2c]
add esp, 8
mov dword [ecx], eax
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov dl, ch
mov al, cl
sar dl, 4
shl al, 2
or dl, al
mov eax, dword [esp + 0x14]
mov byte [ebx + ebp], dl
inc ebp
inc eax
mov cl, ch
mov dword [esp + 0x14], eax
mov al, byte [esp + 0x1e]
mov dl, al
inc edi
sar dl, 2
shl cl, 4
or dl, cl
mov ecx, dword [esp + 0x14]
shl al, 6
or al, byte [esp + 0x1f]
mov byte [ebx + ebp], dl
inc ebp
mov edx, edi
inc ecx
inc edx
mov byte [ebx + ebp], al
mov al, byte [esp + 0x22]
inc ebp
inc ecx
inc edx
mov dword [esp + 0x10], edi
cmp al, 0x3d
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
je 0x4717e3
mov cl, byte [esp + 0x23]
xor eax, eax
cmp cl, 0x3d
setne al
add eax, 2
cmp eax, 3
jl 0x4717e3
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
add edx, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], edx
cmp edx, ecx
jae 0x471804
jmp 0x4716bc
push ecx
push str.Illegal_character__c_in_input._n
call fcn.004763e5
add esp, 8
push 1
call fcn.00475c88
mov eax, dword [esp + 0x134]
mov byte [ebx + ebp], 0
pop edi
pop esi
mov dword [eax], ebp
mov eax, ebx
pop ebp
pop ebx
add esp, 0x118
ret
mov ebx, dword [esp + 0x130]
mov ecx, dword [esp + 0x134]
mov byte [ebx + ebp], 0
pop edi
pop esi
mov dword [ecx], ebp
mov eax, ebx
pop ebp
pop ebx
add esp, 0x118
ret
Function at 0x48669b
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4866d3
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00484752
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048472a
jmp 0x4866df
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x487d8d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x487dcf
call fcn.0048d84a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x487dcf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x487dc6
xor eax, eax
jmp 0x487dd7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00487ddd
pop edi
pop esi
pop ebx
ret 4

Function at 0x48dd7a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48dda8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48ddc6
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048dce0
jmp 0x48ddc6
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48ddc6
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048dce0
test edi, edi
mov eax, edi
jne 0x48ddb0
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4012b4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
lea ebx, [ecx]
sub esi, 0xffffffdc
pop ecx
and edx, ecx
lea ecx, [esp - 0x64]
push 0
pop eax
sub eax, dword [0x40294d]
jbe 0x4012d4
add bl, ch
mov ebx, eax
and ebx, esi
lea ecx, [esp]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
add ebx, esp
lea ecx, [ecx]
cmp eax, 0xb3
jb 0x401300
jne 0x401315
lea ecx, [esp - 4]
mov edx, 0x403cf7
or edi, edx
push 0x402a88
pop edi
push edi
add ebx, eax
sbb ebx, esi
push edx
call dword [sym.imp.KERNEL32.dll_ExitThread]
sub ebx, dword [esp + 8]
inc dword [0x40debf]
jae 0x401323
and ebx, ebp
sbb ebx, ebp
mov dword [0x40dd12], ebx
xor bh, 0xdd
mov eax, dword fs:[0x30]
dec bh
mov ebx, ebp
mov edx, eax
add ebx, ebx
inc bl
sbb ebx, ebp
xor ebx, esi
mov eax, dword [edx + 0x2c]
add bh, cl
add bl, ah
mov cl, byte [eax + 0x6f]
or ebx, edi
shr eax, 0x10
lea ebx, [eax]
sub ebx, esi
sub cl, ah
je 0x401381
sub dword [ebp + 0xc], ebx
dec dword [0x40dcb3]
mov dword [ebp], edx
push sym.imp.KERNEL32.dll__lopen
and ebx, edi
push 0x404a9a
jg 0x401375
lea edx, [edx]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop ecx
or ecx, 0xffffffff
leave
ret
and ebx, ecx
and ebx, edx
dec bh
mov ebx, esi
mov eax, dword [edx + 0xc]
jg 0x401392
mov ebx, ecx
mov ecx, ebx
jg 0x401396
add ebx, edx
mov esi, dword [eax + 0x1c]
sub ebx, esi
lodsd eax, dword [esi]
and ebx, ecx
mov eax, dword [eax + 8]
jae 0x4013a8
neg bx
and ebx, ebp
neg bl
mov edx, dword [eax + 0x3c]
add bl, al
sar ebx, 4
not bl
mov ebx, ecx
mov ecx, ebx
add edx, 0x104
add eax, dword [eax + edx]
jbe 0x4013c8
neg bh
lea ebx, [eax + edx]
add bl, cl
jg 0x4013d1
sar ebx, 0x49
add ebx, eax
inc eax
mov ecx, dword [eax]
sbb ebx, eax
and ecx, dword [eax + 4]
and ebx, ecx
mov ebx, eax
mov eax, ebx
add ecx, 0x40388c
and ebx, ecx
cmp ecx, 0x55848d1
jne 0x4013ca
xor ebx, esi
add bh, bl
xchg edx, eax
jae 0x4013f8
sbb ebx, eax
mov ebx, edx
sub edx, 1
lea ebx, [eax + edx]
mov eax, dword [edx]
jg 0x401406
add ebx, esi
and eax, 0xffff
add bl, ch
add eax, 0x403f00
sub ebx, esp
sub eax, 0x40ca55
jne 0x4013f8
jae 0x401421
mov eax, eax
neg bl
xor dword [0x40df76], edx
mov ebx, eax
mov eax, ebx
push 0x40dfc1
jg 0x401434
sbb ebx, ecx
not bh
mov bl, cl
mov cl, bl
push 0x33
add dword [esp], 0xd
sub ebx, esi
xor ebx, ebx
push 0x2f40
add ebx, eax
jg 0x401451
add ebx, esp
lea ebx, [eax]
push 0x4012e4
jae 0x40145b
ror ebx, 0x20
push 0xfffffffffffffffe
mov ebx, esi
lea ebx, ds:[esp]
inc dword [esp]
mov ebx, esp
mov ebx, ecx
jae 0x40146e
sub ebx, esi
add bh, 8
add bl, ch
mov edx, dword [0x40df76]
call edx
mov bl, cl
mov cl, bl
lea ecx, [0x401067]
mov ebx, edx
sub ecx, 0x400fd1
xor ebx, ecx
mov edx, 0x401562
jbe 0x401498
sub ebx, esi
mov edi, 0xe4
xor dword [edx], edi
not ebx
shl ebx, 0xe4
mov esi, dword [edx]
and ebx, esi
mov bl, al
mov al, 0x62
mov al, bl
add esi, 0xa
mov dword [edx], esi
xor ebx, esi
sbb ebx, edi
add edx, 0xffffffff
lea ebx, [ecx]
mov bl, cl
mov cl, bl
sub ecx, 1
jne 0x401494
neg bx
or ebx, edx
mov edx, 0x12d2ee3e
int3
Function at 0x1003a4e
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x18
push 0x10013d0
call fcn.01005494
mov edi, 0x94
mov eax, edi
call fcn.010054e0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x100d1b0], ecx
mov eax, dword [esi + 4]
mov dword [0x100d1bc], eax
mov edx, dword [esi + 8]
mov dword [0x100d1c0], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x100d1b4], esi
cmp ecx, 2
je 0x1003aae
or esi, 0x8000
mov dword [0x100d1b4], esi
shl eax, 8
add eax, edx
mov dword [0x100d1b8], eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1003ae7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003ae7
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1003aff
cmp eax, 0x20b
je 0x1003aec
mov dword [ebp - 0x1c], edi
jmp 0x1003b13
cmp dword [ecx + 0x84], 0xe
jbe 0x1003ae7
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1003b0d
cmp dword [ecx + 0x74], 0xe
jbe 0x1003ae7
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
push edi
call fcn.01005441
pop ecx
test eax, eax
jne 0x1003b3f
cmp dword [0x100d190], 2
je 0x1003b2c
call fcn.01004cbe
push 0x1c
call fcn.01004af5
push 0xff
call fcn.01004976
pop ecx
pop ecx
mov dword [ebp - 4], edi
call fcn.0100527c
test eax, eax
jge 0x1003b53
push 0x1b
call fcn.01003a29
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x100e824], eax
call fcn.01005156
mov dword [0x100d188], eax
call fcn.010050b4
test eax, eax
jge 0x1003b79
push 8
call fcn.01003a29
pop ecx
call fcn.01004e68
test eax, eax
jge 0x1003b8a
push 9
call fcn.01003a29
pop ecx
call fcn.010049a6
mov dword [ebp - 0x20], eax
cmp eax, edi
je 0x1003b9d
push eax
call fcn.01003a29
pop ecx
mov eax, dword [0x100d1d0]
mov dword [0x100d1d4], eax
push eax
push dword [0x100d1c8]
push dword [0x100d1c4]
call fcn.01003462
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x1c], edi
jne 0x1003bcc
push esi
call fcn.01004ab5
call fcn.01004ad7
jmp 0x1003bfe
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x34]
call fcn.010054cd
ret
Function at 0x1004af5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
xor eax, eax
cmp edx, dword [eax*8 + 0x100c410]
je 0x1004b15
inc eax
cmp eax, 0x12
jb 0x1004b06
shl eax, 3
cmp edx, dword [eax + 0x100c410]
mov dword [ebp + 8], eax
jne 0x1004cb3
mov ecx, dword [0x100d190]
cmp ecx, 1
je 0x1004c88
test ecx, ecx
jne 0x1004b47
cmp dword [0x100c004], 1
je 0x1004c88
cmp edx, 0xfc
je 0x1004cb3
and byte [ebp - 8], 0
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1004b82
push 5
pop ecx
mov esi, 0x1001924
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10c]
lea ebx, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004b91
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x1004bc9
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004ba9
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x1001920
push ebx
call fcn.01007300
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004bce
sub eax, edx
mov ecx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x100c414]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1004be5
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.010054e0
mov edx, esp
push 6
pop ecx
mov esi, 0x1001904
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004c11
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1004c1d
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1004c36
mov eax, dword [ebp + 8]
mov esi, 0x1001900
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 0x100c414]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004c51
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1004c5d
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x10018d8
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.01007fea
add esp, 0xc
jmp 0x1004cb3
mov ecx, dword [eax + 0x100c414]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1004c93
push 0
lea edx, [ebp - 4]
push edx
sub eax, esi
push eax
push ecx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1007fea
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x100d38c], ebx
push esi
push edi
jne 0x100806a
push 0x1002bf0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10080a5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1002be4
push edi
call esi
test eax, eax
mov dword [0x100d38c], eax
je 0x10080a5
push 0x1002bd4
push edi
call esi
push 0x1002bc0
push edi
mov dword [0x100d390], eax
call esi
cmp dword [0x100d1b0], 2
mov dword [0x100d394], eax
jne 0x100806a
push 0x1002ba4
push edi
call esi
test eax, eax
mov dword [0x100d39c], eax
je 0x100806a
push 0x1002b8c
push edi
call esi
mov dword [0x100d398], eax
mov eax, dword [0x100d398]
test eax, eax
je 0x10080af
call eax
test eax, eax
je 0x1008096
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x100d39c]
test eax, eax
je 0x1008096
test byte [ebp - 8], 1
jne 0x10080af
cmp dword [0x100d1bc], 4
jb 0x10080a9
or byte [ebp + 0x12], 0x20
jmp 0x10080ce
xor eax, eax
jmp 0x10080de
or byte [ebp + 0x12], 4
jmp 0x10080ce
mov eax, dword [0x100d390]
test eax, eax
je 0x10080ce
call eax
mov ebx, eax
test ebx, ebx
je 0x10080ce
mov eax, dword [0x100d394]
test eax, eax
je 0x10080ce
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x100d38c]
pop edi
pop esi
pop ebx
leave
ret