joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a820
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44a858]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44a839
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44a848
or bl, 4
test esi, 0x20000000
je 0x44a853
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x450f00
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x450f12
add esp, 0xfffffff0
call fcn.00403ac4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a6f0
mov eax, dword [0x456f08]
mov dword [eax + 4], ebx
mov dword [eax], 0x4512a4
mov eax, dword [0x456f14]
mov dword [eax + 4], ebx
mov dword [eax], 0x4512b0
mov eax, ebx
call fcn.004512bc
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4129e8]
call fcn.00403788
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4129e8]
call fcn.00403788
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4129e8]
call fcn.00403788
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4129e8]
call fcn.00403788
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4129e8]
call fcn.00403788
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44d6d8
push eax
push 0
push 0
mov eax, dword [0x457058]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41c11c]
call fcn.0041d560
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41c11c]
call fcn.0041d560
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41c11c]
call fcn.0041d560
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004516dc
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4515b8
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4515b8
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4515b8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45104f
call fcn.00403b1c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45139c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x451547
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x451528
mov dl, 1
mov eax, dword [0x412e04]
call fcn.00403788
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004044f0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x451517
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043f384
test al, al
je 0x45150a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x451558
lea eax, [ebp - 0x254]
call fcn.00409edc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45150a
xor eax, eax
push ebp
push 0x451503
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x451590
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4514ec
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404760
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4514ec
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404760
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45150a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45140d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.004168e0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45154e
lea eax, [ebp - 0x260]
call fcn.004044f0
ret

Function at 0x451e7c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x458bb0]
cmp byte [eax + 0xa5], 0
jne 0x451eed
cmp dword [0x458bc8], 0
jne 0x451eae
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x451e38
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x458bc8], eax
cmp dword [0x458bc4], 0
jne 0x451ec9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x458bc4], eax
cmp dword [0x458bcc], 0
jne 0x451eed
push esp
push 0
push 0
push 0x451ddc
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x458bcc], eax
pop edx
ret
Function at 0x451fe4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x451ffb
add esp, 0xfffffff0
call fcn.00403ac4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a6f0
mov eax, dword [0x457044]
cmp word [eax + 2], 0
jne 0x452023
mov eax, dword [0x457044]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004536bc
mov eax, dword [0x4570ec]
cmp word [eax + 2], 0
jne 0x45203d
mov eax, dword [0x4570ec]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004538b4
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4129e8]
call fcn.00403788
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4129e8]
call fcn.00403788
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41c8cc]
call fcn.00422608
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x4521c4
mov eax, dword [0x456f6c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004229d8
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x453e54
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x456f6c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d58c
test eax, eax
je 0x452132
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004098d0
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d5b4
test eax, eax
je 0x452146
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404760
mov eax, dword [0x456e68]
cmp byte [eax], 0
jne 0x45217a
mov eax, ebx
call fcn.004522ec
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00454030
mov eax, ebx
call fcn.004549f4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4521ba
call fcn.00403b1c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45256c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x458bb0]
cmp dword [eax + 0x30], 0
je 0x452616
cmp dword [ebx + 0x94], 0
jne 0x452610
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4524fc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x452610
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4525d6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x452610
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414d50
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4525e5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x453178
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4531ad
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004045e0
jmp 0x4531ba
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404544
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45420c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45424d
mov eax, esi
call fcn.0043a9b0
test al, al
je 0x45424d
mov eax, dword [ebx + 0x84]
call fcn.0043a6ac
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45424d
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043a6ac
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x10001880
Capabilities:
Encode data using xor

Disassembly:
popal
sbb bh, byte [ebx]
and dword [ecx + edx*4], ebp
mov dword [0x4f9bda42], eax
push es
mov dword [0x88ab6e81], eax
invd
xor eax, edx
test dword [edi - 0x6ded438b], eax
rol dword [eax + 0x2d8b367e], 1
rol dword [eax], 0x91
in eax, 0x72
add dh, byte [ecx + 0x3d42aad2]
inc esi
pushal
lcall 0x9141, 0x1090ac5f
or byte [ebx], dh
ret 0x8785
add byte [ecx - 0x4bfd8d1b], dl
loope 0x10001806
stosb byte es:[edi], al
inc edx
cmp eax, 0x5f9a6046
lodsb al, byte [esi]
nop
adc byte [ecx - 0x6f], al
cmpsd dword cs:[esi], dword es:[edi]
xor byte [ebp + 0x35], al
inc ebp
dec edi
mov dword [0x3e39ae1b], eax
mov esp, 0x67e4ce45
sbb ebp, dword [esi + 0x45bc3e39]
into
in al, 0x67
rol ecx, 0x96
sub esp, dword [edx - 0x2b5341b9]
and dword [edx + 0x1cedeae4], 0x4a
not byte [esi]
cld
js 0x1000182c
xor eax, 0x5034c930
xchg dword [ebx - 0x6b46f35c], ebp
adc al, 0x29
inc ebx
push 0xc05b0606
dec esp
xchg ebx, eax
jnp 0x1000181c
xchg edi, eax
mov cl, 0x17
pop ss
pop edi
dec edi
je 0x10001848
stosd dword es:[edi], eax
ret 0x2d85

Function at 0x10009a30
Capabilities:
Encode data using xor

Disassembly:
sar dword [ebx], 0x3e
xor al, 0xfb
push ds
in al, dx
les esi, [eax + 0x77]
pop eax
stosb byte es:[edi], al
xlatb
adc al, 0xea
pop esi
sub al, 0xb3
add bl, byte [0x6bb588eb]
mov ah, 0xcb
mov dh, 0x94
clc
out 0x8d, al
addps xmm2, xmm4
out dx, eax
test al, 0x32
sub dl, byte [edx - 0x7d3aaedb]
mov eax, 0x1ed58baf
jge 0x100099ea
xor dword [ecx + 3], ecx
xchg esp, eax
xor al, 0xa5
pop ebp
adc dl, byte [esi - 0x34454db0]
dec edi
sbb eax, 0x2d88688
xchg ebx, eax
pop ebp
add eax, 0x76cbf39
cdq
retf 0x8dd8
rcr byte [bx + si - 0x1a2a], 0x48
lodsb al, byte [esi]
xchg edi, eax
test al, 0x3f
or eax, 0xb8713de
sub edx, dword [edx - 0x638608a0]
aas
xor bh, cl
cdq
loope 0x100099d0
inc esi
invalid

Function at 0x10048390
Capabilities:
Encode data using xor

Disassembly:
imul dword [esi - 0x34259ad6]
movsd dword es:[edi], dword [esi]
ficom dword [ecx + ebx*8 + 0x2f]
invalid
push cs
inc ebp
fsubr dword [edx]
salc
cld
cmp byte [ecx + 0x40], 0x5f
test dword [edx], eax
xor byte [ebp - 0x79], ah
pop edx
fucom st(4)
pushal
xor ch, dh
jecxz 0x10048334
pushal
out 0x41, eax
adc dword [edi + eax*8], esi
jno 0x100483a8
invalid
Function at 0x10002448
Capabilities:
Check os version

Disassembly:
mov eax, 0x10024694
call fcn.10013e48
sub esp, 0xac
push ebx
push esi
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0xb8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xb8]
push eax
mov dword [ebp - 0xb8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xb4], 6
jb 0x10002554
push str.Advapi32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x100024a9
mov eax, 0x80004005
jmp 0x10002556
push str.AddMandatoryAce
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x14], ebx
je 0x1000249f
mov dword [ebp - 0x10], ebx
push 0x40
lea eax, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.10002776
mov esi, dword [ebp - 0x10]
push 2
push 0x40
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x10002515
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push 2
push esi
mov byte [ebp - 0x24], 1
mov byte [ebp - 0x23], 1
mov byte [ebp - 0x1d], 0x10
mov dword [ebp - 0x1c], 0x1000
mov dword [ebp - 0x18], ebx
call dword [ebp - 0x14]
test eax, eax
jne 0x10002525
cmp esi, ebx
je 0x1000249f
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1000249f
push esi
push ebx
push ebx
push ebx
push 0x10
push 6
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x80004005
cmp dword [ebp - 0x10], ebx
je 0x10002550
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
jmp 0x10002556
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x10002880
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
and dword [ebp - 4], 0
push esi
push edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp + 0x14]
xor eax, eax
push eax
push edi
push dword [ebp + 0x18]
push esi
call fcn.1001bd70
xor ecx, ecx
push ecx
push edi
push edx
push eax
call fcn.10014450
sub esi, eax
lea ecx, [esi + ebx]
push ecx
push eax
mov eax, dword [ebp + 8]
push edx
push dword [ebp + 0x10]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x100028ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
xor eax, eax
lea esi, [ebp - 0x40]
call fcn.10002b05
push 0x1002b160
mov eax, esi
push eax
call fcn.10012f6c
mov ecx, dword [ebp + 0xc]
add esi, eax
mov dword [ecx + 4], esi
add esi, ebx
pop edi
mov dword [ecx], eax
mov dword [ecx + 8], esi
mov eax, ecx
pop esi
leave
ret 0x14
Function at 0x10010ebe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10010ed3
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x10010ee5
xor eax, eax
jmp 0x10010f17
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x10010f09
cmp esi, eax
jae 0x10010ee1
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10010efb
cmp esi, eax
jae 0x10010ee1
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret

Function at 0x1001246c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.10012750
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10012507
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x10030978]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x10012507
cmp eax, 1
je 0x10012528
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10012507
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x100124d4
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x10012503
xor eax, eax
inc eax
jmp 0x10012547
cmp edi, eax
jae 0x1001250b
xor eax, eax
jmp 0x10012547
cmp eax, esi
jae 0x10012512
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x10030978]
jmp 0x1001252b
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100134db
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x100134f8
call fcn.10014c32
mov dword [eax], 0x16
xor eax, eax
jmp 0x10013562
push esi
push 0x8c
push 1
call fcn.10017b27
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x1001354d
push esi
call fcn.1001656f
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x1001352b
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x10013446
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x10013561
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.100123fb
test ebx, ebx
pop ecx
je 0x1001355f
push ebx
call fcn.10014c44
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10013566
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x10013656
mov eax, 0x94
call fcn.10012750
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x100136cb
mov ecx, dword [esi + 0x10]
mov dword [0x10030978], ecx
mov eax, dword [esi + 4]
mov dword [0x10030984], eax
mov edx, dword [esi + 8]
mov dword [0x10030988], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x1003097c], esi
je 0x100135d1
or esi, 0x8000
mov dword [0x1003097c], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x10030980], eax
call fcn.10014e55
test eax, eax
pop ecx
je 0x100136cb
call fcn.10016769
test eax, eax
jne 0x100135fe
call fcn.10014ea6
jmp 0x100136cb
call fcn.10018223
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10032370], eax
call fcn.10018101
mov dword [0x10030958], eax
call fcn.10017be2
test eax, eax
jl 0x1001364f
call fcn.1001805f
test eax, eax
jl 0x1001364a
call fcn.10017e2c
test eax, eax
jl 0x1001364a
push 0
call fcn.10014594
test eax, eax
pop ecx
jne 0x1001364a
inc dword [0x10030954]
jmp 0x100136dc
call fcn.10017de0
call fcn.10016552
jmp 0x100135f4
test eax, eax
jne 0x10013686
cmp dword [0x10030954], eax
jle 0x100136cb
dec dword [0x10030954]
cmp dword [0x100309b4], eax
jne 0x10013675
call fcn.100146d2
call fcn.10017de0
call fcn.10016552
call fcn.10014ea6
jmp 0x100136dc
cmp eax, 2
jne 0x100136cf
push 0x8c
push 1
call fcn.10017b27
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x100136cb
push esi
push dword [0x1002dd88]
call dword [0x10030b6c]
test eax, eax
push esi
je 0x100136c5
call fcn.1001656f
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x100136dc
call fcn.100123fb
pop ecx
xor eax, eax
jmp 0x100136df
cmp eax, 3
jne 0x100136dc
push 0
call fcn.1001673a
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc
Function at 0x100145fe
Capabilities:
Terminate process

Disassembly:
push 8
push 0x10026e00
call fcn.10013f84
push 8
call fcn.10014e0a
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x100309b8], esi
jne 0x10014632
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x100309b4], esi
mov al, byte [ebp + 0x10]
mov byte [0x100309b0], al
cmp dword [ebp + 0xc], edi
jne 0x1001467c
cmp dword [0x10032368], edi
je 0x1001466c
mov eax, dword [0x10032364]
sub eax, 4
mov dword [0x10032364], eax
cmp eax, dword [0x10032368]
jb 0x1001466c
mov eax, dword [eax]
cmp eax, edi
je 0x1001464d
call eax
jmp 0x1001464d
push 0x1002d09c
mov eax, 0x1002d094
call fcn.1001457c
pop ecx
push 0x1002d0a8
mov eax, 0x1002d0a0
call fcn.1001457c
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x100146ad
cmp dword [ebp + 0x10], edi
jne 0x100146bb
mov dword [0x100309b8], esi
push dword [ebp + 8]
call fcn.1001453a
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x100146ba
push 8
call fcn.10014d55
pop ecx
ret
call fcn.10013fbf
ret
Function at 0x100182ab
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x1002d9d0]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x1002dfe0]
je 0x100182e0
inc eax
cmp eax, 0x13
jb 0x100182d1
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x1002dfe0]
jne 0x10018406
mov eax, dword [0x10030960]
cmp eax, 1
je 0x100183de
cmp eax, edx
jne 0x10018310
cmp dword [0x10030964], 1
je 0x100183de
cmp ecx, 0xfc
je 0x10018406
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10018346
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.10013800
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.10013900
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1001837a
mov eax, edi
push eax
call fcn.10013900
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x10027540
push edi
call fcn.10013040
add esp, 0x10
push edi
call fcn.10013900
push dword [esi + 0x1002dfe4]
mov ebx, eax
call fcn.10013900
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.10012750
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.10013800
push edi
push ebx
call fcn.10013810
push 0x10027520
push ebx
call fcn.10013810
push dword [esi + 0x1002dfe4]
push ebx
call fcn.10013810
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.10019b3e
add esp, 0x2c
jmp 0x10018406
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x1002dfe4]
push dword [esi]
call fcn.10013900
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.10013e37
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret