joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1e04250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1e18808
push 0x1e08288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1e04329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1e04329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.01e071d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x1e04329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x1e04329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x1e0432c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.01e04351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1e04d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1e04d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x1e04d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1e04d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1e04d94
push eax
push esi
call fcn.01e0720b
add esp, 8
pop esi
ret 0x10

Function at 0x1e04da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1e04e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x1e04e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x1e1d320
push ecx
mov dword [esp + 0x1c], 4
call fcn.01e06dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x1e04dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x1e04e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1e04ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x1e04eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x1e1d320
push ecx
mov dword [esp + 0x1c], 4
call fcn.01e06dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x1e04eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x1e04e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x1e05000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x1e05131
push esi
call fcn.01e08145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.01df7080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x1e05131
push 0
push ebp
call fcn.01df73a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.01df7260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x1e0508b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.01df72f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x1e05121
push 0x1e1d918
push edi
call fcn.01e063f0
push eax
push ebx
push esi
call fcn.01e04f60
push 0x1e1d8f8
push edi
call fcn.01e063f0
push eax
push ebx
push esi
call fcn.01e04f60
push 0x1e1d8d8
push edi
call fcn.01e063f0
push eax
push ebx
push esi
call fcn.01e04f60
push 0x1e1d8c0
push edi
call fcn.01e063f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.01e04f60
push 0x1e1d8a0
push edi
call fcn.01e063f0
push eax
push ebx
push esi
call fcn.01e04f60
push 0x1e1d888
push edi
call fcn.01e063f0
push eax
push ebx
push esi
call fcn.01e04f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x1e061b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.01e06140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.01e06140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.01e06140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.01e06140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x1e06bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1e06c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x1e1887c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1e06c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1e06c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x7c34100e
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x7c38b2ac]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebx, ebx
xor esi, esi
cmp eax, ebx
push 2
pop ebp
jne 0x7c3410c5
call edi
mov esi, eax
cmp esi, ebx
je 0x7c34800f
mov dword [0x7c38b2ac], 1
cmp esi, ebx
je 0x7c348030
cmp word [esi], bx
mov eax, esi
je 0x7c34106e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add eax, ebp
cmp word [eax], bx
jne 0x7c341060
add eax, ebp
cmp word [eax], bx
jne 0x7c341060
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, esi
push ebx
sar eax, 1
inc eax
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x7c3410b5
push ebp
call sym.MSVCR71.dll_malloc
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x7c3410b5
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
je 0x7c34803d
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
cmp eax, 1
jne 0x7c348050
jmp 0x7c341044
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x7c348026
mov eax, ebp
mov dword [0x7c38b2ac], eax
jmp 0x7c3410c5
mov eax, dword [0x7c38b2ac]
jmp 0x7c3410c5
call edi
mov esi, eax
cmp esi, ebx
je 0x7c348058
jmp 0x7c34104c
push dword [esp + 0x10]
call sym.MSVCR71.dll_free
pop ecx
mov dword [esp + 0x10], ebx
jmp 0x7c3410b1
cmp eax, ebp
je 0x7c34805f
cmp eax, ebx
je 0x7c34805f
xor eax, eax
jmp 0x7c3410be
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
je 0x7c348058
cmp byte [esi], bl
je 0x7c348079
inc eax
cmp byte [eax], bl
jne 0x7c34806f
inc eax
cmp byte [eax], bl
jne 0x7c34806f
sub eax, esi
inc eax
mov ebp, eax
push ebp
call sym.MSVCR71.dll_malloc
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x7c34808f
xor edi, edi
jmp 0x7c34809a
push ebp
push esi
push edi
call sym.MSVCR71.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, edi
jmp 0x7c3410be
Function at 0x7c3410d3
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x7c38b2a8]
push ebp
xor ebp, ebp
cmp eax, ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jne 0x7c3410ff
call esi
test eax, eax
je 0x7c347f99
mov dword [0x7c38b2a8], 1
call esi
pop esi
pop ebp
ret
cmp eax, 1
jne 0x7c347fb7
jmp 0x7c3410fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x7c347fb0
mov dword [0x7c38b2a8], 2
jmp 0x7c347fbc
xor eax, eax
jmp 0x7c3410fc
cmp eax, 2
jne 0x7c347fb0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebp
push ebp
push 0xffffffffffffffff
mov ebx, eax
push ebx
push 1
push ebp
call edi
mov esi, eax
cmp esi, ebp
je 0x7c348002
lea eax, [esi + esi]
push eax
call sym.MSVCR71.dll_malloc
mov ebp, eax
test ebp, ebp
pop ecx
je 0x7c348002
push esi
push ebp
push 0xffffffffffffffff
push ebx
push 1
push 0
call edi
test eax, eax
jne 0x7c348006
push ebp
call sym.MSVCR71.dll_free
pop ecx
xor eax, eax
jmp 0x7c348008
mov eax, ebp
pop edi
pop ebx
jmp 0x7c3410fc

Function at 0x7c341aed
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x7c38b118]
jne 0x7c34c229
ret
push 8
push 0x7c37f6d0
call fcn.7c34230b
and dword [ebp - 4], 0
push 0
push 1
call sym.MSVCR71.dll___security_error_handler
pop ecx
pop ecx
jmp 0x7c34c24d
or dword [ebp - 4], 0xffffffff
push 3
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x7c341f13
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x11a0
call fcn.7c341395
mov eax, dword [0x7c38b118]
push ebx
mov dword [ebp - 4], eax
push 0x1090
lea eax, [ebp - 0x119c]
push eax
push 0x7c37a2c0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x7c347adf
cmp dword [sym.MSVCR71.dll__osplatform], 2
jne 0x7c347bd0
cmp dword [sym.MSVCR71.dll__winmajor], 5
jb 0x7c347bd0
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop ebx
call fcn.7c341aed
leave
ret
cmp eax, 1
je 0x7c341f65
jmp 0x7c341f48
xor ebx, ebx
cmp byte [ebp - 0x119c], bl
lea ecx, [ebp - 0x119c]
je 0x7c347b02
mov al, byte [ecx]
cmp al, 0x61
jl 0x7c347afd
cmp al, 0x7a
jg 0x7c347afd
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], bl
jne 0x7c347aef
push 0x16
lea eax, [ebp - 0x119c]
push eax
push str.__GLOBAL_HEAP_SELECTED
call sym.MSVCR71.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x7c347b24
lea eax, [ebp - 0x119c]
jmp 0x7c347b78
push 0x104
lea eax, [ebp - 0x10c]
push eax
push ebx
mov byte [ebp - 8], bl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [ebp - 0x10c], bl
lea ecx, [ebp - 0x10c]
je 0x7c347b5b
mov al, byte [ecx]
cmp al, 0x61
jl 0x7c347b56
cmp al, 0x7a
jg 0x7c347b56
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], bl
jne 0x7c347b48
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x119c]
push eax
call sym.MSVCR71.dll_strstr
cmp eax, ebx
pop ecx
pop ecx
je 0x7c341f48
push 0x2c
push eax
call sym.MSVCR71.dll_strchr
cmp eax, ebx
pop ecx
pop ecx
je 0x7c341f48
lea ecx, [eax + 1]
jmp 0x7c347b90
inc ecx
cmp byte [ecx], 0x20
je 0x7c347b8f
mov dl, byte [ecx]
xor eax, eax
cmp dl, 0x30
jl 0x7c341f48
cmp dl, 0x39
jg 0x7c347bb9
movsx edx, dl
lea eax, [eax + eax*4]
inc ecx
lea eax, [edx + eax*2 - 0x30]
mov dl, byte [ecx]
cmp dl, 0x30
jge 0x7c347ba2
cmp eax, 2
je 0x7c341f65
cmp eax, 3
je 0x7c341f65
jmp 0x7c341f70
lea eax, [ebp - 0x11a0]
push eax
call fcn.7c349f55
cmp byte [ebp - 0x11a0], 6
pop ecx
sbb eax, eax
add eax, 3
jmp 0x7c341f65
Function at 0x7c34229f
Capabilities:
Accept command line arguments

Disassembly:
mov edi, 0x94
mov eax, edi
call fcn.7c341395
mov esi, esp
push esi
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x7c342307
mov ecx, dword [esi + 0x10]
mov dword [sym.MSVCR71.dll__osplatform], ecx
mov eax, dword [esi + 4]
mov dword [sym.MSVCR71.dll__winmajor], eax
mov edx, dword [esi + 8]
mov dword [sym.MSVCR71.dll__winminor], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [sym.MSVCR71.dll__osver], esi
jne 0x7c3476fd
shl eax, 8
add eax, edx
push 1
mov dword [sym.MSVCR71.dll__winver], eax
call fcn.7c341f77
test eax, eax
pop ecx
je 0x7c342307
call fcn.7c341922
test eax, eax
je 0x7c34770e
call fcn.7c341a17
test eax, eax
jl 0x7c34771d
call fcn.7c34100e
mov dword [0x7c38b140], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [sym.MSVCR71.dll__acmdln], eax
call fcn.7c3410d3
mov dword [sym.MSVCR71.dll__wcmdln], eax
call fcn.7c341cb3
call fcn.7c341ed1
test eax, eax
jl 0x7c347718
push 0
call fcn.7c341da3
test eax, eax
pop ecx
jne 0x7c347718
inc dword [0x7c38b13c]
jmp 0x7c3422fb
cmp eax, 3
jne 0x7c3422fb
push edi
call fcn.7c342262
pop ecx
jmp 0x7c3422fb
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
push edi
je 0x7c341e00
xor edi, edi
cmp eax, edi
je 0x7c347724
cmp eax, 2
jne 0x7c342291
push 0x8c
push 1
call sym.MSVCR71.dll_calloc
mov esi, eax
cmp esi, edi
pop ecx
pop ecx
je 0x7c342307
push esi
push dword [0x7c38b430]
call dword [0x7c38c914]
test eax, eax
push esi
je 0x7c347760
call fcn.7c3423c6
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
xor eax, eax
inc eax
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 0xc
xor eax, eax
jmp 0x7c3422fe
or esi, 0x8000
mov dword [sym.MSVCR71.dll__osver], esi
jmp 0x7c341e51
call fcn.7c349f82
jmp 0x7c342307
call fcn.7c34b835
call fcn.7c349615
jmp 0x7c34770e
cmp dword [0x7c38b13c], edi
jle 0x7c342307
dec dword [0x7c38b13c]
cmp dword [0x7c390f84], edi
jne 0x7c347743
call sym.MSVCR71.dll__cexit
cmp dword [ebp + 0x10], edi
jne 0x7c3422fb
call fcn.7c34b835
call fcn.7c349615
call fcn.7c349f82
jmp 0x7c3422fb
call sym.MSVCR71.dll_free
pop ecx
jmp 0x7c342307
Function at 0x7c347632
Capabilities:
Terminate process

Disassembly:
push 8
call sym.MSVCR71.dll__lock
jmp 0x7c347643
pop ecx
pop ecx
push 0x7c38cc90
push 0x7c38cc88
call sym.MSVCR71.dll__initterm
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x7c3476ce
jmp 0x7c3476b6
pop ecx
ret
ret
push 8
push 0x7c37f0d0
call fcn.7c34230b
jmp 0x7c3423d9
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x7c390f88], esi
jne 0x7c347664
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x7c390f84], esi
mov al, byte [ebp + 0x10]
mov byte [0x7c390f80], al
cmp dword [ebp + 0xc], edi
jne 0x7c3423e7
cmp dword [0x7c38b2cc], edi
je 0x7c3476a2
mov eax, dword [0x7c38b2c8]
sub eax, 4
mov dword [0x7c38b2c8], eax
cmp eax, dword [0x7c38b2cc]
jb 0x7c3476a2
mov eax, dword [eax]
cmp eax, edi
je 0x7c347683
call eax
jmp 0x7c347683
push 0x7c38cca4
push 0x7c38cc94
call sym.MSVCR71.dll__initterm
jmp 0x7c3423e5
cmp dword [ebp + 0x10], edi
jne 0x7c3476e3
mov dword [0x7c390f88], esi
push dword [ebp + 8]
call fcn.7c348cd5
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x7c342407
push 8
call sym.MSVCR71.dll__unlock
jmp 0x7c342406
call fcn.7c342346
jmp 0x7c342408

Function at 0x7c348cd5
Capabilities:
Terminate process

Disassembly:
push str.mscoree.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x7c348cfa
push str.CorExitProcess
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x7c348cfa
push dword [esp + 4]
call eax
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x7c348d3e
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x7c38b118]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x7c38ccb0]
je 0x7c348d73
inc eax
cmp eax, 0x13
jb 0x7c348d64
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x7c38ccb0]
jne 0x7c348e99
mov eax, dword [0x7c390f94]
cmp eax, 1
je 0x7c348e71
cmp eax, edx
jne 0x7c348da3
cmp dword [0x7c390f98], 1
je 0x7c348e71
cmp ecx, 0xfc
je 0x7c348e99
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x7c348dd9
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call sym.MSVCR71.dll__mbscpy
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call sym.MSVCR71.dll_strlen
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x7c348e0d
mov eax, edi
push eax
call sym.MSVCR71.dll_strlen
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x7c37f4c8
push edi
call sym.MSVCR71.dll_strncpy
add esp, 0x10
push edi
call sym.MSVCR71.dll_strlen
push dword [esi + 0x7c38ccb4]
mov ebx, eax
call sym.MSVCR71.dll_strlen
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.7c341395
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call sym.MSVCR71.dll__mbscpy
push edi
push ebx
call sym.MSVCR71.dll__mbscat
push 0x7c37f4a8
push ebx
call sym.MSVCR71.dll__mbscat
push dword [esi + 0x7c38ccb4]
push ebx
call sym.MSVCR71.dll__mbscat
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.7c34c130
add esp, 0x2c
jmp 0x7c348e99
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x7c38ccb4]
push dword [esi]
call sym.MSVCR71.dll_strlen
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.7c341aed
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret

Function at 0x7c349434
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
xor ebx, ebx
test edi, edi
jne 0x7c349450
call sym.MSVCR71.dll__errno
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x7c3494c2
push esi
push 0x8c
push 1
call sym.MSVCR71.dll_calloc
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x7c3494a8
push esi
call fcn.7c3423c6
mov eax, dword [esp + 0x1c]
pop ecx
push esi
push 4
push esi
push 0x7c3493a3
push dword [esp + 0x24]
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
mov dword [esi + 4], edi
je 0x7c3494a0
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x7c3494bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call sym.MSVCR71.dll_free
test ebx, ebx
pop ecx
je 0x7c3494ba
push ebx
call fcn.7c349ee2
pop ecx
or eax, 0xffffffff
jmp 0x7c3494c1
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x7c34958a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x7c3495a7
call sym.MSVCR71.dll__errno
mov dword [eax], 0x16
xor eax, eax
jmp 0x7c349611
push esi
push 0x8c
push 1
call sym.MSVCR71.dll_calloc
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x7c3495fc
push esi
call fcn.7c3423c6
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x7c3495da
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x7c3494f6
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x7c349610
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call sym.MSVCR71.dll_free
test ebx, ebx
pop ecx
je 0x7c34960e
push ebx
call fcn.7c349ee2
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x7c3496ee
Capabilities:
Enumerate files on windows

Disassembly:
cmp dword [esp + 4], 0
je 0x7c34974c
cmp dword [0x7c3910ac], 0
jne 0x7c349712
push 0x244
call sym.MSVCR71.dll_malloc
test eax, eax
pop ecx
mov dword [0x7c3910ac], eax
je 0x7c349775
mov eax, dword [0x7c3910b0]
test eax, eax
je 0x7c349729
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
and dword [0x7c3910b0], 0
push dword [0x7c3910ac]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [0x7c3910b0], eax
je 0x7c349775
mov eax, dword [0x7c3910ac]
add eax, 0x2c
ret
push dword [0x7c3910ac]
push dword [0x7c3910b0]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x7c349743
push dword [0x7c3910b0]
call dword [sym.imp.KERNEL32.dll_FindClose]
and dword [0x7c3910b0], 0
xor eax, eax
ret

Function at 0x7c349bdc
Capabilities:
Enumerate files on windows

Disassembly:
cmp dword [esp + 4], 0
je 0x7c349c3a
cmp dword [0x7c3912cc], 0
jne 0x7c349c00
push 0x354
call sym.MSVCR71.dll_malloc
test eax, eax
pop ecx
mov dword [0x7c3912cc], eax
je 0x7c349c63
mov eax, dword [0x7c3912c8]
test eax, eax
je 0x7c349c17
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
and dword [0x7c3912c8], 0
push dword [0x7c3912cc]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [0x7c3912c8], eax
je 0x7c349c63
mov eax, dword [0x7c3912cc]
add eax, 0x2c
ret
push dword [0x7c3912cc]
push dword [0x7c3912c8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x7c349c31
push dword [0x7c3912c8]
call dword [sym.imp.KERNEL32.dll_FindClose]
and dword [0x7c3912c8], 0
xor eax, eax
ret