joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5853b0
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x585570
sub esp, 0x84
lea eax, [0x60da40]
mov dword [esp], eax
mov dword [esp + 4], 0x24
mov dword [esp + 8], 0x24
call fcn.00447550
mov eax, dword [esp + 0xc]
mov dword [esp + 0x80], eax
nop
lea edi, [esp + 0x20]
xor eax, eax
call fcn.0045e869
nop
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov eax, dword [esp + 0x8c]
test eax, eax
jle 0x585457
mov ecx, dword [esp + 0x88]
xor edx, edx
jmp 0x585533
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.00546280
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp ecx, 0x24
jl 0x58548d
mov ecx, 0x24
mov edx, dword [esp + 0x80]
cmp eax, edx
je 0x5854a8
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.0045ef80
mov eax, dword [esp + 0x88]
mov dword [esp], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 8], eax
call fcn.00585280
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
cmp ecx, 0x14
jl 0x5854df
mov ecx, 0x14
mov edx, dword [esp + 0x80]
lea ebx, [edx + 0x10]
cmp eax, ebx
je 0x585504
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.0045ef80
mov edx, dword [esp + 0x80]
mov dword [esp + 0x94], edx
mov dword [esp + 0x98], 0x24
mov dword [esp + 0x9c], 0x24
add esp, 0x84
ret
mov ebx, dword [esp + 0x7c]
add ebx, 0xc
mov ecx, ebx
mov edx, eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x7c], ecx
mov eax, dword [ecx]
mov ebx, dword [ecx + 4]
mov ebp, dword [ecx + 8]
lea esi, [esp + 0x20]
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebp
call fcn.00546080
mov eax, dword [esp + 0x1c]
inc eax
mov ecx, dword [esp + 0x8c]
cmp ecx, eax
jg 0x585528
jmp 0x585457
call fcn.0045d190
jmp fcn.005853b0
Function at 0x587fc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58818f
sub esp, 0x40
lea eax, [0x60da40]
mov dword [esp], eax
mov dword [esp + 4], 0
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x68]
lea ebx, [edx + ecx]
mov dword [esp + 0x30], ebx
mov dword [esp + 8], ebx
call fcn.00447550
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x30]
cmp ecx, edx
jbe 0x588042
lea ebx, [0x60da40]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
call fcn.004476d0
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x5c]
mov edx, ebx
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
mov dword [esp], eax
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
call fcn.0045ef80
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
cmp eax, ecx
jb 0x588070
mov edx, dword [esp + 0x38]
jmp 0x5880a4
lea edx, [0x60da40]
mov dword [esp], edx
mov ebx, dword [esp + 0x38]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.004476d0
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov ecx, edx
mov edx, eax
mov eax, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], edx
mov ecx, dword [esp + 0x5c]
add ecx, edx
mov dword [esp], ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 8], ecx
call fcn.0045ef80
lea eax, [0x60da40]
mov dword [esp], eax
mov dword [esp + 4], 0x30
mov dword [esp + 8], 0x30
call fcn.00447550
mov eax, dword [esp + 0xc]
mov dword [esp + 0x3c], eax
movzx ecx, word [esp + 0x44]
mov word [esp], cx
mov ecx, dword [esp + 0x48]
mov dword [esp + 4], ecx
call fcn.00587f00
mov edx, dword [esp + 8]
mov eax, dword [edx]
mov ecx, dword [str.master_secret]
mov ebx, dword [0x7e9fc4]
mov ebp, dword [0x7e9fc8]
mov esi, dword [esp + 0x3c]
mov dword [esp], esi
mov dword [esp + 4], 0x30
mov dword [esp + 8], 0x30
mov edi, dword [esp + 0x4c]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x50]
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x54]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x2c], ecx
call eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], 0x30
mov dword [esp + 0x78], 0x30
add esp, 0x40
ret
call fcn.0045d190
jmp fcn.00587fc0
Function at 0x588ce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x588e8a
sub esp, 0x48
movzx eax, word [esp + 0x78]
cmp ax, 0x303
jb 0x588d0e
movzx ecx, byte [esp + 0x80]
jmp 0x588d1b
movzx ecx, byte [esp + 0x80]
cmp cl, 0xe4
jne 0x588d53
mov edx, dword [esp + 0x6c]
test edx, edx
je 0x588e71
cmp cl, 0xe4
je 0x588d32
cmp ax, 0x303
jmp 0x588d57
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x94], edx
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], ecx
add esp, 0x48
ret
cmp ax, 0x303
jae 0x588de5
cmp cl, 0xe3
jne 0x588daf
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov eax, dword [eax + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x48
ret
lea edi, [esp]
lea esi, [esp + 0x4c]
call fcn.0045ed0e
call fcn.005889c0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x48
ret
mov eax, dword [esp + 0x84]
mov dword [esp], eax
call fcn.004ed290
mov eax, dword [esp + 4]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
mov edx, dword [eax + 0x20]
mov ebx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call edx
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x1c]
mov ecx, dword [esp + 0x44]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x48
ret
lea eax, [0x60d840]
mov dword [esp], eax
lea eax, [0x69d948]
mov dword [esp + 4], eax
call fcn.004334d0
nop
call fcn.0045d190
jmp fcn.00588ce0
Function at 0x5c1e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c2040
sub esp, 0x34
lea eax, [0x6077c0]
mov dword [esp], eax
call fcn.0040b5f0
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
lea ecx, [0x613ae0]
mov dword [esp], ecx
call fcn.0040b5f0
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.004a00f0
lea edi, [esp + 0x20]
lea esi, [esp]
call fcn.0045ed5e
mov eax, dword [esp + 0x38]
test byte [eax], al
lea edi, [eax + 0x78]
mov ecx, dword [0x816df0]
test ecx, ecx
jne 0x5c1e91
lea esi, [esp + 0x20]
call fcn.0045ed5e
jmp 0x5c1eaf
lea eax, [0x639de0]
mov dword [esp], eax
mov dword [esp + 4], edi
lea eax, [esp + 0x20]
mov dword [esp + 8], eax
call fcn.00410bf0
mov eax, dword [esp + 0x38]
movzx ecx, byte [eax + 0x4d]
test cl, cl
je 0x5c1ebe
mov ecx, 1
jmp 0x5c1ed4
mov dword [esp], eax
call fcn.005bfb20
movzx eax, byte [esp + 4]
xor eax, 1
mov ecx, eax
mov eax, dword [esp + 0x38]
test cl, cl
jne 0x5c2016
lea edi, [eax + 0x8c]
mov ecx, dword [0x816df0]
test ecx, ecx
jne 0x5c1ef5
xor eax, eax
call fcn.0045e87b
jmp 0x5c1f07
lea eax, [0x639de0]
mov dword [esp], eax
mov dword [esp + 4], edi
call fcn.00410dd0
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 0x5c]
test ecx, ecx
je 0x5c1f16
mov ecx, dword [ecx]
jmp 0x5c1f18
xor ecx, ecx
mov edx, ecx
add ecx, 1
mov ebx, edx
sar edx, 0x1f
add ebx, 1
adc edx, 0
cmp dword [eax + 0xa4], ecx
setae cl
test edx, edx
sete dl
setl bl
and edx, ecx
or ebx, edx
test bl, bl
jne 0x5c1ff0
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
test edx, edx
jne 0x5c1fbe
lea eax, [0x6077c0]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00404620
mov eax, dword [0x816df0]
mov ecx, dword [esp + 8]
test eax, eax
jne 0x5c1f7b
mov eax, dword [esp + 0x1c]
mov dword [eax], ecx
jmp 0x5c1f88
mov edi, dword [esp + 0x1c]
mov eax, ecx
call fcn.0045e5d0
mov eax, edi
mov dword [esp], 0x10
lea ecx, [0x6563ac]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x10], ebx
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x14], ebp
call fcn.0043e530
mov eax, dword [esp + 0x38]
inc dword [eax + 0x64]
mov ecx, dword [eax + 0x38]
mov dword [esp], ecx
call fcn.0046e550
mov eax, dword [esp + 0x38]
dec dword [eax + 0x64]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
mov ebx, dword [ecx + 4]
test edx, edx
je 0x5c1e62
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ebx
add esp, 0x34
ret
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
test eax, eax
je 0x5c2002
mov dword [esp], eax
call fcn.00404fa0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
add esp, 0x34
ret
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
test eax, eax
je 0x5c2028
mov dword [esp], eax
call fcn.00404fa0
mov eax, dword [0x7efa28]
mov ecx, dword [0x7efa2c]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
add esp, 0x34
ret
call fcn.0045d190
jmp fcn.005c1e10
Function at 0x10001010
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x10001030
Capabilities:
Create thread
Get common file path
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push edi
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x120]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [ebp - 0x120]
add ecx, 0xffffffff
mov dword [ebp - 0x124], ecx
mov edx, dword [ebp - 0x124]
mov al, byte [edx + 1]
mov byte [ebp - 0x125], al
add dword [ebp - 0x124], 1
cmp byte [ebp - 0x125], 0
jne 0x1000106c
mov edi, dword [ebp - 0x124]
mov ecx, dword [str.config.ini]
mov dword [edi], ecx
mov edx, dword [0x1000927c]
mov dword [edi + 4], edx
mov eax, dword [0x10009280]
mov dword [edi + 8], eax
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
push 4
push 0x3000
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10001010
add esp, 8
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
push section..text
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 1
test edx, edx
je 0x10001146
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10001130
xor eax, eax
pop edi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10001175
mov esp, ebp
pop ebp
ret

Function at 0x10001175
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x1000117f
repz ret
jmp fcn.100013d2
Function at 0x100065a8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000154a
and dword [ebp - 4], 0
cmp dword [0x1000b5e8], 0
mov ebx, eax
jne 0x10006659
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000670a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1000670a
push eax
call fcn.100014d8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1000b5e8], eax
call esi
push eax
call fcn.100014d8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1000b5ec], eax
call esi
push eax
call fcn.100014d8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1000b5f0], eax
call esi
push eax
call fcn.100014d8
pop ecx
mov dword [0x1000b5f8], eax
test eax, eax
je 0x10006659
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100014d8
pop ecx
mov dword [0x1000b5f4], eax
mov eax, dword [0x1000b5f4]
cmp eax, ebx
je 0x100066b1
cmp dword [0x1000b5f8], ebx
je 0x100066b1
push eax
call fcn.10001553
push dword [0x1000b5f8]
mov esi, eax
call fcn.10001553
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100066b1
test edi, edi
je 0x100066b1
call esi
test eax, eax
je 0x100066a8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100066a8
test byte [ebp - 0xc], 1
jne 0x100066b1
or dword [ebp + 0x10], 0x200000
jmp 0x100066ea
mov eax, dword [0x1000b5ec]
cmp eax, ebx
je 0x100066ea
push eax
call fcn.10001553
pop ecx
test eax, eax
je 0x100066ea
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100066ea
mov eax, dword [0x1000b5f0]
cmp eax, ebx
je 0x100066ea
push eax
call fcn.10001553
pop ecx
test eax, eax
je 0x100066ea
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1000b5e8]
call fcn.10001553
pop ecx
test eax, eax
je 0x1000670a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000670c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100112d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + ecx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 4
jb 0x100112d8
mov eax, esi
pop esi
ret
Function at 0x10014f98
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10014fc7
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
call fcn.1001505a
add esp, 0xc
jmp 0x10015056
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001500b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10015009
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x10015056
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10015039
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x10015056
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.10025597
mov dword [eax], 0x785734cb
jmp 0x1001502e
mov esp, ebp
pop ebp
ret
Function at 0x1001c012
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 0x7fa0
mov dword [ebp - 0x14], 0x10007348
cmp dword [ebp - 0xc], 0x7fac
jle 0x1001c0a1
and dword [ebp - 4], 0
jmp 0x1001c03c
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4e42
jge 0x1001c0a1
and dword [ebp - 8], 0
jmp 0x1001c052
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x5b1f
jge 0x1001c09f
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
sar eax, cl
cdq
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x38]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x38]
call fcn.100252df
jmp 0x1001c04b
jmp 0x1001c035
push dword [ebp + 8]
push 0x3904
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x18]
push 1
push 0x5a0d
push dword [ebp + 0x14]
call fcn.1001c0da
add esp, 0x20
cmp dword [ebp - 0xc], 0x7e69
jge 0x1001c0d6
push dword [ebp - 0x14]
call fcn.1008287d
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001cdc2
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x18], 0x5f96
mov dword [ebp - 0x48], 0x10007560
cmp dword [ebp - 0x18], 0x609a
jle 0x1001ce9e
and dword [ebp - 8], 0
jmp 0x1001cdf0
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x4ba
jge 0x1001ce9e
and dword [ebp - 0xc], 0
jmp 0x1001ce0a
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x612e
jge 0x1001ce99
and dword [ebp - 0x10], 0
jmp 0x1001ce24
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x7bf
jge 0x1001ce94
and dword [ebp - 0x14], 0
jmp 0x1001ce3a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3a33
jge 0x1001ce92
mov eax, dword [ebp - 8]
cdq
idiv dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
shl edx, cl
mov ecx, dword [ebp - 0x14]
sar edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x54]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x70]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x70]
call fcn.100252df
jmp 0x1001ce33
jmp 0x1001ce1d
jmp 0x1001ce03
jmp 0x1001cde9
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001cf44
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1001cef7
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1001ceee
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x50], 0x100951f4
jmp 0x1001cf42
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001cf25
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1001cf42
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x40]
call fcn.10025597
mov dword [eax], 0x5bb08661
jmp 0x1001cf1a
jmp 0x1001cf61
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x44]
push 0x2012
push 0
push 0x4df4
call fcn.1001af4d
add esp, 0x10
cmp dword [ebp - 0x18], 0x5d72
jge 0x1001cf73
push dword [ebp - 0x48]
call fcn.1008287d
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001cf77
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001cfa5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push 0x6f9d
push 1
call fcn.1001d15b
add esp, 0xc
jmp 0x1001d157
lea eax, [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x24], 0x6cda
mov dword [ebp - 0x2c], 0x100075c8
cmp dword [ebp - 0x24], 0x6e36
jle 0x1001d078
and dword [ebp - 8], 0
jmp 0x1001cfd3
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x748c
jge 0x1001d078
and dword [ebp - 0x1c], 0
jmp 0x1001cfed
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1ded
jge 0x1001d073
and dword [ebp - 0x18], 0
jmp 0x1001d003
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3912
jge 0x1001d06e
and dword [ebp - 0x10], 0
jmp 0x1001d019
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xafa
jge 0x1001d06c
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
shl eax, cl
xor eax, dword [ebp - 8]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 0x54], eax
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea ecx, [ebp - 0x6c]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.100252df
jmp 0x1001d012
jmp 0x1001cffc
jmp 0x1001cfe6
jmp 0x1001cfcc
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x1001d091
push 0
push 0
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x1001d145
mov dword [ebp - 0x20], 0x41d2
mov dword [ebp - 0x34], 0x10007624
cmp dword [ebp - 0x20], 0x44e1
jle 0x1001d121
and dword [ebp - 0xc], 0
jmp 0x1001d0b5
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3cca
jge 0x1001d121
and dword [ebp - 0x14], 0
jmp 0x1001d0cb
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x35f
jge 0x1001d11f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
sar eax, cl
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [ebp - 0x30], ax
push dword [ebp - 0x44]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x84]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x84]
call fcn.100252df
jmp 0x1001d0c4
jmp 0x1001d0ae
mov byte [ebp - 1], 0
cmp dword [ebp - 0x20], 0x3eff
jge 0x1001d137
push dword [ebp - 0x34]
call fcn.1008287d
pop ecx
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001d145
call dword [sym.imp.KERNEL32.dll_GetACP]
cmp dword [ebp - 0x24], 0x6c8d
jge 0x1001d157
push dword [ebp - 0x2c]
call fcn.1008287d
pop ecx
mov esp, ebp
pop ebp
ret