joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003906a
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10039106
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100390bc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x100390ba
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x10039104
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100390ea
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10039104
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.10017939
or dword [eax], 0xffffffff
jmp 0x100390df
jmp 0x10039122
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 1
call fcn.1002a791
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10039265
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100392cb
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100392b4
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x100392b2
push 0x11f0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x100392c9
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0xf2e96673
jmp 0x100392e7
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x20]
push 0
push dword [ebp - 0x24]
call fcn.10033fcb
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10064ce5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10070750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10054ec8
mov dword [ebp - 0x14], eax
cmp dword [0x1065da00], esi
jne 0x10064dd8
push 0x800
push esi
push 0x100076c4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10064d65
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10064eb8
push esi
push esi
push 0x100076c4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10064eb8
push 0x100076dc
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10064eb8
push eax
call ebx
push 0x100076e8
push edi
mov dword [0x1065da00], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100076f8
push edi
mov dword [0x1065da04], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000770c
push edi
mov dword [0x1065da08], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065da10], eax
test eax, eax
je 0x10064dd5
push 0x10007728
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065da0c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10064dfd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10064df0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10064e12
push 4
pop eax
jmp 0x10064eba
cmp dword [ebp - 0x14], esi
je 0x10064e12
push dword [0x1065da00]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10064df7
mov eax, dword [0x1065da0c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10064e70
cmp dword [0x1065da10], edi
je 0x10064e70
push eax
call ebx
push dword [0x1065da10]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10064e70
test eax, eax
je 0x10064e70
call ecx
test eax, eax
je 0x10064e65
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10064e65
test byte [ebp - 8], 1
jne 0x10064e70
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10064ea0
mov eax, dword [0x1065da04]
cmp eax, edi
je 0x10064e9d
push eax
call ebx
test eax, eax
je 0x10064e9d
call eax
mov esi, eax
test esi, esi
je 0x10064e9d
mov eax, dword [0x1065da08]
cmp eax, edi
je 0x10064e9d
push eax
call ebx
test eax, eax
je 0x10064e9d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1065da00]
call ebx
test eax, eax
je 0x10064eb8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10064eba
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100523a8
mov esp, ebp
pop ebp
ret
Function at 0x1001e048
Capabilities:
Get file size

Disassembly:
sub esp, 0x14
lea ecx, [esp + 8]
mov dword [esp + 4], ebx
mov dword [esp + 0x10], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [esp + 8], 0
push ecx
push dword [esp + 0x1c]
call sub.KERNEL32.DLL_GetFileSize
cmp eax, 0xffffffff
setne dl
mov byte [esp + 0xc], dl
je 0x1001e095
push eax
mov eax, dword [esp + 0xc]
call fcn.100226a0
mov ebx, dword [esp + 0x10]
mov dword [ebx], eax
mov dword [ebx + 4], edx
movsx eax, byte [esp + 0xc]
mov ebx, dword [esp + 4]
add esp, 0x14
ret 4

Function at 0x1001e0a4
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
mov ecx, dword [esp + 0x24]
mov dword [esp + 8], esi
mov esi, dword [esp + 0x28]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
or ecx, dword [esp + 0x20]
je 0x1001e146
push 0
lea edx, [esp + 0x1c]
mov eax, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x2c]
sub eax, dword [esp + 0x18]
sbb edx, dword [esp + 0x1c]
push edx
push eax
mov eax, 0xffff0000
call fcn.100226cc
mov ecx, dword [esp + 0x18]
add ecx, esi
push eax
mov ebx, eax
push ecx
push edi
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x1001e112
cmp dword [esp + 0x18], ebx
je 0x1001e126
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
add esp, 0x1c
xor eax, eax
ret 0x10
mov eax, ebx
xor edx, edx
add dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
adc dword [esp + 0x14], edx
mov edx, dword [esp + 0x14]
cmp edx, dword [esp + 0x24]
jne 0x1001e0d5
cmp eax, dword [esp + 0x20]
jne 0x1001e0d5
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
add esp, 0x1c
mov eax, 1
ret 0x10
Function at 0x1001e9e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x18]
test edx, edx
mov dword [esp + 4], esi
mov esi, dword [esp + 0x1c]
mov dword [esp], ebx
mov ebx, edx
mov dword [esp + 8], edi
mov dword [esp + 0x10], eax
je 0x1001ea07
cmp dword [esp + 0x1c], 0
jne 0x1001ea1a
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0x14
xor eax, eax
ret 8
mov ecx, edx
and ecx, 3
shr ebx, 2
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x1001ea61
movzx edx, word [esi]
and edx, 0xffff
add eax, edx
mov ecx, eax
shl ecx, 0x10
movzx edx, word [esi + 2]
and edx, 0xffff
shl edx, 0xb
xor edx, eax
xor ecx, edx
mov eax, ecx
shr ecx, 0xb
add esi, 4
add eax, ecx
dec ebx
test ebx, ebx
jne 0x1001ea31
mov ebx, dword [esp + 0xc]
cmp ebx, 1
je 0x1001eab5
cmp ebx, 2
je 0x1001ea9a
cmp ebx, 3
je 0x1001ea76
jmp 0x1001eac7
movzx edx, word [esi]
and edx, 0xffff
add eax, edx
mov ebx, eax
shl ebx, 0x10
movzx edi, byte [esi + 2]
shl edi, 0x12
xor ebx, edi
xor eax, ebx
mov ecx, eax
shr ecx, 0xb
add eax, ecx
jmp 0x1001eac7
movzx ebx, word [esi]
and ebx, 0xffff
add eax, ebx
mov edi, eax
shl edi, 0xb
xor eax, edi
mov ecx, eax
shr ecx, 0x11
add eax, ecx
jmp 0x1001eac7
movzx edi, byte [esi]
add eax, edi
mov ecx, eax
shl ecx, 0xa
xor eax, ecx
mov edx, eax
shr edx, 1
add eax, edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
shl eax, 3
xor dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
shr edx, 5
add dword [esp + 0x10], edx
mov ebx, dword [esp + 0x10]
shl ebx, 4
xor dword [esp + 0x10], ebx
mov esi, dword [esp + 0x10]
shr esi, 0x11
add dword [esp + 0x10], esi
mov ecx, dword [esp + 0x10]
shl ecx, 0x19
xor dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
shr eax, 6
add dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0x14
ret 8
Function at 0x100219f4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x10021b92
push edx
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], edi
call fcn.1002635c
mov dword [ebp - 4], 0
mov eax, dword [0x1008afe8]
mov ecx, dword fs:[0x2c]
mov ebx, dword [ecx + eax*4]
mov edx, dword [ebx + 0xe0]
test edx, edx
je 0x10021a68
mov eax, edx
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.10021b6b
pop eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret
mov edx, 0x100737c0
push edx
call fcn.1001e334
push 0
call fcn.10024ad0
mov ebx, eax
lea esi, [eax + 0x30]
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [ebx + 0xc], eax
call sub.KERNEL32.DLL_GetCurrentThread
mov dword [ebp - 0x18], eax
call sub.KERNEL32.DLL_GetCurrentProcess
lea ecx, [ebp - 0x1c]
mov edi, eax
push 2
push 1
push 0
push ecx
push edi
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
push edi
call sub.KERNEL32.DLL_DuplicateHandle
mov edx, dword [ebp - 0x1c]
mov dword [ebx + 8], edx
call fcn.1002636c
mov dword [esi], eax
mov dword [esi + 4], eax
mov byte [ebx + 0x28], 1
call fcn.10026374
mov dword [ebx + 0x50], eax
mov ecx, dword [0x1008afe8]
mov edx, dword fs:[0x2c]
push ebx
mov ecx, dword [edx + ecx*4]
xor eax, eax
mov dword [ecx + 0xe0], ebx
call fcn.10024b2c
mov edx, 0x10091394
push edx
call sub.KERNEL32.DLL_EnterCriticalSection
add esp, 4
cmp dword [0x100913d8], 0
je 0x10021b14
mov ecx, dword [0x100913d8]
mov dword [esi + 0x10], ecx
mov edx, dword [0x100913d8]
mov dword [edx + 0x14], esi
mov dword [0x100913d8], esi
mov ecx, 0x10091394
mov edi, 0x10091388
push ecx
call sub.KERNEL32.DLL_LeaveCriticalSection
cmp dword [0x10091360], 0
je 0x10021b3a
mov byte [0x10091350], 1
mov eax, ebx
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.10021b6b
pop eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret
Function at 0x100223e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x34
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x24], edi
mov edi, 0xffff
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x30], eax
mov esi, dword [eax]
cmp esi, ebp
jb 0x1002241a
mov dword [esp + 4], 0xdf
mov dword [esp], 0x100223b4
call fcn.10018044
mov ecx, dword [esp + 0x3c]
movzx ebx, byte [ecx + esi]
test bl, 0x80
je 0x10022582
mov edx, 1
movzx ecx, bl
mov byte [esp + 0x2c], cl
mov dword [esp + 0x28], esi
movsx eax, byte [esp + 0x2c]
movsx ecx, dl
shl al, cl
test al, 0x80
jne 0x10022454
cmp edx, 1
je 0x100225a4
jmp 0x10022460
inc edx
cmp edx, 4
ja 0x100225a4
jmp 0x1002243b
mov ecx, 7
mov edi, 1
sub ecx, edx
shl edi, cl
dec edi
movzx ecx, bl
and edi, ecx
mov ecx, dword [esp + 0x28]
lea eax, [edx + ecx - 1]
cmp eax, ebp
jae 0x100225a4
lea esi, [ecx + 1]
cmp esi, ebp
jb 0x100224a2
mov dword [esp + 4], 0x107
mov dword [esp], 0x100223b4
call fcn.10018044
mov esi, dword [esp + 0x3c]
add esi, ecx
movzx eax, byte [esi + 1]
movzx ecx, bl
and cl, 0xfe
cmp cl, 0xc0
je 0x100225a4
cmp bl, 0xe0
jne 0x100224cf
movzx ecx, al
and cl, 0xe0
cmp cl, 0x80
je 0x100225a4
cmp bl, 0xf0
jne 0x100224e3
movzx ecx, al
and cl, 0xf0
cmp cl, 0x80
je 0x100225a4
cmp bl, 0xf8
jne 0x100224f7
movzx ecx, al
and cl, 0xf8
cmp cl, 0x80
je 0x100225a4
cmp bl, 0xfc
jne 0x1002250b
movzx ecx, al
and cl, 0xfc
cmp cl, 0x80
je 0x100225a4
mov esi, 1
cmp edx, esi
je 0x10022557
mov ecx, dword [esp + 0x28]
add ecx, esi
cmp ecx, ebp
jb 0x10022532
mov dword [esp + 4], 0x111
mov dword [esp], 0x100223b4
call fcn.10018044
mov eax, dword [esp + 0x3c]
movzx ebx, byte [ecx + eax]
mov ecx, ebx
and cl, 0xc0
cmp cl, 0x80
jne 0x100225a4
shl edi, 6
movzx ecx, bl
and ecx, 0x3f
or edi, ecx
inc esi
cmp esi, edx
jne 0x10022514
cmp edi, 0xd800
jb 0x10022571
lea ebx, [edi - 0xe000]
cmp ebx, 0x101fff
jbe 0x10022571
xor eax, eax
jmp 0x10022576
mov eax, 1
xor al, 1
jne 0x100225a4
mov esi, dword [esp + 0x28]
add esi, edx
jmp 0x10022586
movzx edi, bl
inc esi
mov edx, dword [esp + 0x30]
mov eax, edi
mov dword [edx], esi
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
add esp, 0x34
ret 8
mov ecx, 0x100223b4
mov ebx, 0x11
mov esi, dword [esp + 0x28]
mov dword [esp + 0x14], 0x124
mov edx, 0x100223c8
mov eax, 0x16
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.1001f488
mov eax, edi
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
add esp, 0x34
ret 8

Function at 0x1002340c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov dword [esp + 8], esi
mov esi, dword [esp + 0x18]
mov dword [esp + 4], ebx
mov dword [esp + 0x10], eax
mov eax, esi
call fcn.100299c8
mov ebx, eax
mov byte [esp + 0xc], bl
and bl, byte [esp + 0x10]
push esi
push dword [esp + 0x10]
movzx eax, bl
call fcn.100299d8
xor al, 1
jne 0x1002341f
movzx eax, bl
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
add esp, 0x14
ret 4
Function at 0x10024444
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x2c
mov ecx, 9
xor eax, eax
mov dword [esp + 4], edi
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push ecx
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [esp + 0xc]
mov dword [0x10091358], edx
mov edi, dword [esp + 4]
add esp, 0x2c
ret

Function at 0x10024540
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x100246b3
push edx
mov dword fs:[0], esp
sub esp, 0x24
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x18], eax
movsx ecx, byte [0x10091350]
mov byte [ebp - 0x1c], cl
mov byte [0x10091350], 1
mov dword [ebp - 4], 0
mov ebx, eax
mov edi, eax
add edi, 0xc
push edi
mov edx, 0x1002bb2c
mov esi, dword [eax + 0x24]
push 4
add ebx, 8
push eax
push edx
push esi
push 0
call fcn.10064d44
mov dword [ebx], eax
add esp, 0x18
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 8], 0
jne 0x100245bc
mov ebx, 0x10024510
xor eax, eax
push ebx
push 0x15
call fcn.1002bacc
mov esi, 0x10091394
mov ebx, 0x10091388
push esi
call sub.KERNEL32.DLL_EnterCriticalSection
mov dword [ebp - 4], 1
inc dword [0x100913e8]
mov edx, dword [0x100913e8]
shl edx, 2
push edx
push dword [0x100913e4]
call fcn.10063bf8
mov dword [0x100913e4], eax
mov ecx, dword [ebp - 0x18]
mov ebx, dword [0x100913e8]
lea eax, [eax + ebx*4]
mov dword [eax - 4], ecx
add esp, 8
mov esi, dword [ebp - 0x18]
push dword [esi + 8]
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 0xffffffff
jne 0x10024627
mov edx, 0x10024528
xor eax, eax
push edx
push 0x15
call fcn.1002bacc
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xc]
push eax
push 0xffffffffffffffff
push ecx
push 0x10073680
call fcn.1001d55c
add esp, 0xc
pop eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret
Function at 0x10026534
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x5c
xor ecx, ecx
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x60]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
mov eax, dword [0x1008b19c]
cmp eax, ecx
js 0x10026566
cmp eax, 0x3c
jl 0x10026559
jmp 0x10026566
mov edx, dword [0x1008b19c]
mov ecx, dword [edx*4 + 0x1008b044]
lea eax, [esp + 0x44]
xor edx, edx
mov dword [esp + 0x34], ecx
push eax
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov word [eax + 0x14], dx
push ecx
call sub.KERNEL32.DLL_GetConsoleScreenBufferInfo
test eax, eax
setne cl
mov byte [esp + 0x5a], cl
mov dword [esp + 4], 0x1008e540
mov dword [esp], 0x1008b18c
call fcn.10064ebc
test eax, eax
jg 0x1002667e
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
push ebx
lea edi, [esp + 0x28]
mov edx, fcn.10026758
push edx
push edi
call fcn.1002d0f4
cmp dword [esp + 0x24], 0
je 0x10026726
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
test ebx, ebx
je 0x10026601
mov eax, dword [ebx]
mov ecx, dword [eax]
push dword [ecx + 0x14]
push dword [ecx + 0x10]
lea eax, [esp + 0x24]
call fcn.10026758
mov esi, 0x1008e544
push esi
call sub.KERNEL32.DLL_LoadLibraryW
mov ebx, eax
test eax, eax
je 0x1002665b
mov edx, 0x1008e55c
push edx
push ebx
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
je 0x1002665b
cmp dword [esp + 0x24], 0
je 0x10026637
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov word [ecx + edi*2], 0
mov esi, dword [esp + 0x24]
cmp dword [esp + 0x1c], 0
je 0x10026650
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov word [edi + edx*2], 0
push 0x10
push dword [esp + 0x20]
push esi
push 0
call eax
push ebx
call sub.KERNEL32.DLL_FreeLibrary
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.10063694
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
call fcn.10063694
jmp 0x10026726
cmp byte [esp + 0x5a], 0
je 0x10026736
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
push ebx
lea eax, [esp + 0x18]
mov ecx, fcn.10026758
push ecx
push eax
call fcn.1002d0f4
cmp dword [esp + 0x14], 0
je 0x10026726
call sub.KERNEL32.DLL_GetConsoleOutputCP
mov dword [esp + 0x2c], eax
push 0
push 0
push 0
push 0
push dword [esp + 0x28]
push dword [esp + 0x28]
push 0
push eax
call sub.KERNEL32.DLL_WideCharToMultiByte
mov dword [esp + 0x30], eax
mov dword [esp], eax
call fcn.10063c3c
mov ebx, eax
test eax, eax
je 0x1002671a
push 0
push 0
push dword [esp + 0x38]
push ebx
push dword [esp + 0x28]
push dword [esp + 0x28]
push 0
push dword [esp + 0x48]
call sub.KERNEL32.DLL_WideCharToMultiByte
push 0
push 0
push dword [esp + 0x38]
push ebx
push dword [esp + 0x44]
call sub.KERNEL32.DLL_WriteFile
mov dword [esp], ebx
call fcn.10063694
mov ebx, dword [esp + 0x14]
mov dword [esp], ebx
call fcn.10063694
mov ebx, dword [esp + 8]
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
add esp, 0x5c
ret
push ebx
mov edx, 0x10026808
xor esi, esi
push edx
push esi
call fcn.1002d0f4
mov ebx, dword [esp + 8]
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
add esp, 0x5c
ret
Function at 0x10027f34
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x82c
mov ecx, 0x200
mov eax, 0xffffffff
mov dword [esp + 0x18], edi
lea edi, [esp + 0x2c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
rep stosd dword es:[edi], eax
xor ebx, ebx
mov eax, dword [ebx*8 + 0x10073b70]
mov edx, dword [ebx*8 + 0x10073b74]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
push 0x800
lea ecx, [esp + 0x30]
push ecx
push dword [esp + 0x30]
call sub.KERNEL32.DLL_GetEnvironmentVariableA
mov edi, eax
test eax, eax
je 0x10027fd8
mov dword [esp + 8], edi
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x1c]
mov dword [esp + 0xc], edx
mov edx, 0x100710c0
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.1001e76c
lea ecx, [esp + 0x1c]
mov dword [esp + 0xc], 0x10013c64
mov dword [esp + 8], 1
mov dword [esp + 4], ecx
mov dword [esp], 0x100710c0
call fcn.1001e76c
inc ebx
cmp ebx, 3
jb 0x10027f64
mov dword [esp + 0xc], 0x10013b78
lea eax, [esp + 0x1c]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], 0x100710c0
call fcn.1001e76c
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
add esp, 0x82c
ret

Function at 0x100281d8
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x64
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov dword [esp + 0x60], eax
call fcn.100282ec
cmp eax, 0xffffffff
mov dword [esp + 0x44], eax
jne 0x100281f9
hlt
lea eax, [esp + 0x4c]
mov ecx, 0xffffffff
mov edx, dword [esp + 0x68]
mov dword [eax], ecx
mov esi, dword [esp + 0x6c]
mov edi, dword [esp + 0x60]
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
xor ecx, ecx
mov dword [esp + 0x10], 0x100281c4
mov dword [esp + 0xc], 0xe
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], 0x10013c18
mov dword [esp + 0x1c], 1
push ecx
push edi
push eax
mov eax, 0xa
push 0x14
call fcn.1001f598
mov esi, dword [esp + 0x74]
xor ebx, ebx
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x70]
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], 0x100281d4
mov dword [esp + 0x2c], 2
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], esi
mov eax, dword [esp + ebx*8 + 0xc]
mov edx, dword [esp + ebx*8 + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], edx
push 0
push 0
push dword [esp + 0x44]
push dword [esp + 0x4c]
push dword [esp + 0x54]
call sub.KERNEL32.DLL_WriteFile
lea ecx, [ebx + 1]
mov eax, dword [esp + ecx*8 + 0xc]
mov dword [esp + 0x3c], eax
mov edx, dword [esp + ecx*8 + 0x10]
mov dword [esp + 0x40], edx
push 0
push 0
push dword [esp + 0x44]
push dword [esp + 0x4c]
push dword [esp + 0x54]
call sub.KERNEL32.DLL_WriteFile
add ebx, 2
cmp ebx, 6
jb 0x1002827f
call fcn.10065f4c
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0x64
ret 0x10