joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ee058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x7ee1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7ee07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7ee06a
add dl, dl
jne 0x7ee089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7ee0dc
xor eax, eax
add dl, dl
jne 0x7ee096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7ee17d
add dl, dl
jne 0x7ee0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7ee0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7ee0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7ee0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7ee0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7ee075
mov eax, 1
add dl, dl
jne 0x7ee0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7ee0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7ee0e1
sub eax, ebx
mov ebx, 1
jne 0x7ee128
mov ecx, 1
add dl, dl
jne 0x7ee10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7ee119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7ee105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7ee075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7ee13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7ee14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7ee136
cmp eax, 0x7d00
jae 0x7ee16d
cmp eax, 0x500
jb 0x7ee168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7ee075
cmp eax, 0x7f
ja 0x7ee170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7ee075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7ee19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7ee075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10087ea
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100e160]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [0x100e280], 1
push ebx
push esi
push edi
jne 0x1008819
or dword [0x100e280], 1
call fcn.01008789
mov dword [0x100e27c], eax
push 4
pop eax
call fcn.0100bf30
mov esi, esp
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100883b
xor eax, eax
jmp 0x10088f8
mov ebx, dword [ebp - 0x28]
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x4c]
lea edi, [eax - 1]
not edi
and edi, esi
sub edi, eax
mov dword [ebp - 0xc], eax
mov eax, dword [0x100e180]
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xffff1000
add esi, 0x11000
add esi, ebx
cmp edi, esi
jb 0x1008834
cmp eax, 1
je 0x10088d9
mov dword [ebp - 8], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1008834
mov eax, dword [ebp - 0x20]
add dword [ebp - 8], eax
test dword [ebp - 0x1c], ebx
je 0x1008882
test dword [ebp - 0x18], 0x100
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
je 0x10088b4
xor eax, eax
inc eax
jmp 0x10088f8
cmp edi, eax
jb 0x1008834
cmp eax, esi
jae 0x10088c3
mov dword [ebp - 8], esi
push 4
push ebx
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x100e180]
jmp 0x10088dc
mov dword [ebp - 8], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0x10]
push ecx
inc eax
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x5c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100be41
leave
ret

Function at 0x1008fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
cmp word [ecx], 0
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
je 0x100902b
cmp word [eax], 0
push ebx
push esi
push edi
je 0x1009026
mov ebx, dword [sym.imp.USER32.dll_CharNextW]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
jmp 0x100900c
movzx eax, word [edi]
test ax, ax
je 0x100902f
movzx ecx, word [esi]
movzx eax, ax
sub ecx, eax
jne 0x1009012
push esi
call ebx
push edi
mov dword [ebp - 4], eax
call ebx
mov ecx, dword [ebp - 4]
sub eax, edi
sub ecx, esi
xor eax, ecx
test eax, 0xfffffffe
jne 0x1009012
jmp 0x1009007
inc esi
inc esi
movzx ecx, word [esi]
inc edi
inc edi
movzx eax, word [edi]
sub ecx, eax
je 0x100900c
cmp esi, dword [ebp - 4]
jb 0x1008ff9
cmp word [esi], 0
jne 0x1008fcc
cmp word [edi], 0
je 0x100902f
push dword [ebp + 8]
call ebx
cmp word [eax], 0
mov dword [ebp + 8], eax
jne 0x1008fc4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [ebp + 8]
jmp 0x1009028
Function at 0x1009b4f
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x100e160]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
mov eax, ecx
mov ecx, dword [ebp + 8]
push esi
push 0x2001f
push ecx
push dword [eax]
mov dword [ebp - 0x21c], ecx
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], esi
call fcn.01008bcd
mov edi, eax
cmp edi, esi
je 0x1009bc2
lea ecx, [ebp - 0x214]
call fcn.01008b5a
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100be41
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x1009be0
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x214]
call fcn.01009b4f
cmp eax, esi
jne 0x1009c2b
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x208], 0x100
call edi
test eax, eax
je 0x1009bca
lea ecx, [ebp - 0x214]
call fcn.01008b5a
push dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x218]
call fcn.01008ad4
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.01008b5a
mov eax, esi
jmp 0x1009bb2

Function at 0x100a326
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x88], eax
cmp eax, edi
jne 0x100a34a
xor al, al
jmp 0x100a36c
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x100a30e
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
cmp eax, edi
setne cl
mov dword [esi + 0x8c], eax
mov al, cl
pop edi
pop esi
leave
ret
Function at 0x100b3b5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e160]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
push 2
push edi
push dword [ebp + 8]
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
mov dword [ebp - 0xc], ebx
cmp ebx, edi
jne 0x100b407
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jg 0x100b3fb
mov esi, eax
jmp 0x100b4fb
and eax, 0xffff
or eax, 0x80070000
jmp 0x100b3f4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
jne 0x100b437
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x100b4f0
and eax, 0xffff
or eax, 0x80070000
jmp 0x100b4f0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, edi
je 0x100b41a
push esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp byte [esi + ebx], 0
mov edi, ebx
je 0x100b4a1
lea edi, [esi + 1]
cmp edi, 0x400
ja 0x100b479
push edi
call fcn.0100890f
test al, al
je 0x100b479
mov eax, edi
call fcn.0100bef0
mov edi, esp
jmp 0x100b484
push edi
lea ecx, [ebp - 8]
call fcn.0100a375
mov edi, eax
test edi, edi
jne 0x100b48f
mov esi, 0x8007000e
jmp 0x100b4f2
lea eax, [esi + 1]
push eax
push ebx
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov byte [edi + esi], 0
test edi, edi
jne 0x100b4a9
xor eax, eax
jmp 0x100b4e4
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea ebx, [esi + esi]
cmp ebx, 0x400
ja 0x100b4d3
push ebx
call fcn.0100890f
test al, al
je 0x100b4d3
mov eax, ebx
call fcn.0100bef0
mov eax, esp
jmp 0x100b4dc
push ebx
lea ecx, [ebp - 8]
call fcn.0100a375
push esi
push edi
push eax
call fcn.010089e2
push dword [ebp + 0x14]
lea ecx, [ebp - 0x14]
push eax
call fcn.0100b1e2
mov esi, eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 8]
call fcn.01009935
mov eax, esi
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100be41
leave
ret 0x10
Function at 0x100b6d9
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100e160]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor esi, esi
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
push dword [ebp + 8]
mov ebx, 0x100e1e8
push 0x100e118
mov ecx, ebx
call fcn.01009b01
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x100e270], esi
mov dword [0x100e274], esi
mov esi, 0x1002258
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
mov dword [0x100e26c], eax
lea eax, [ebp - 0xc]
movsw word es:[edi], word [esi]
xor edi, edi
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x10], edi
jmp 0x100b76a
push 0x1002240
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100b7c2
push 0x100222c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100b7d7
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.010098ae
mov esi, eax
cmp esi, edi
jne 0x100b745
mov ecx, ebx
call fcn.0100a326
push 2
push 4
push ebx
call fcn.010094ef
call fcn.010098fc
mov eax, dword [0x100e018]
mov esi, 0x100e018
cmp eax, esi
je 0x100b7b7
test byte [eax + 0x3c], 1
je 0x100b7b7
cmp byte [eax + 0x39], 7
jb 0x100b7b7
push 0x1001da4
push 0xa
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0100276f
push edi
push edi
push edi
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x100b7ff
push edi
push edi
push 0x65
push ebx
call fcn.0100b58a
push edi
push 1
push ebx
call fcn.0100b003
jmp 0x100b7eb
push edi
push 1
push 0x65
push ebx
call fcn.0100b58a
push edi
push 1
push ebx
call fcn.0100af51
mov dword [ebp - 0x10], eax
jmp 0x100b846
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x30]
push eax
call edi
test eax, eax
jne 0x100b7f0
mov eax, dword [0x100e018]
cmp eax, esi
je 0x100b830
test byte [eax + 0x3c], 1
je 0x100b830
cmp byte [eax + 0x39], 7
jb 0x100b830
push 0x1001da4
push 0xb
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0100276f
call fcn.010097ca
push ebx
call fcn.01009544
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call fcn.01009593
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100be41
leave
ret 0x10
Function at 0x100bad5
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x100e2a0], 0
push esi
jne 0x100ba43
call fcn.0100b93a
test eax, eax
je 0x100ba86
mov eax, dword [0x100e2a0]
cmp eax, 1
jne 0x100ba64
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x100ba86
pop esi
ret
push eax
call dword [0x100e2a8]
test eax, eax
jne 0x100bace
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x100ba8a
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x100e2a0]
call dword [0x100e2a8]
mov edi, eax
test edi, edi
je 0x100baaf
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x100bacb
mov edi, esi
add esi, 0xff0
push edi
push dword [0x100e2a0]
call dword [0x100e2a4]
add edi, 0x10
cmp edi, esi
jb 0x100bab7
mov eax, edi
pop edi
pop esi
ret
jmp 0x100ba30

Function at 0x100c532
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100e160]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor eax, eax
xor ecx, ecx
mov dword [esi], eax
mov dword [esi + 4], eax
mov word [esi + 8], cx
cmp dword [0x100e600], eax
jne 0x100c5c7
push 0x110
push eax
lea eax, [ebp - 0x114]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [0x100e600], 1
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100c5c7
cmp dword [ebp - 0x114], 5
jb 0x100c5ab
cmp dword [ebp - 0x110], 1
jae 0x100c5b4
cmp dword [ebp - 0x114], 6
jb 0x100c5c7
cmp dword [ebp - 0x108], 2
jne 0x100c5c7
mov dword [0x100e17c], 0x7f
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0100be41
leave
ret
Function at 0x100cbdb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
call fcn.0100c8ef
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x100cbfd
mov eax, 0x80070057
jmp 0x100ccdd
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x80070057
push dword [ebp + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call edi
test eax, eax
jne 0x100ccd9
cmp dword [ebp - 8], 1
je 0x100cc41
cmp dword [ebp - 8], 2
je 0x100cc41
cmp dword [ebp - 8], 7
jne 0x100ccd9
shr dword [ebp - 4], 1
test byte [esi + 8], 0x20
je 0x100cc83
mov eax, dword [esi + 4]
cmp dword [ebp - 4], eax
jb 0x100cc55
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [esi]
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov ecx, dword [esi + 4]
cmp ecx, ebx
jle 0x100cc7d
mov edx, dword [esi]
xor edi, edi
mov word [edx + ecx*2 - 2], di
cmp eax, ebx
jne 0x100ccd9
jmp 0x100ccc4
push dword [ebp - 4]
mov ecx, esi
call fcn.0100c694
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x100ccd9
mov ecx, dword [ebp - 4]
add ecx, ecx
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov ecx, esi
test eax, eax
je 0x100ccbc
lea eax, [ebp - 0x10]
push eax
call fcn.0100c6c0
jmp 0x100ccd9
push dword [ebp - 0x10]
call fcn.0100c99f
cmp dword [ebp - 8], 2
je 0x100cccf
mov dword [ebp - 0xc], ebx
jmp 0x100ccd9
mov ecx, esi
call fcn.0100cb1d
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10044d0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x101107c]
push esi
push 1
mov dword [ebp - 4], eax
mov eax, ecx
push 5
lea ecx, [ebp - 0x210]
push ecx
push dword [eax]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x10015dc
lea eax, [ebp - 0x210]
push eax
call esi
push 0x14
call fcn.010035fb
push eax
lea eax, [ebp - 0x210]
push eax
call esi
xor eax, eax
push eax
push 0x8000000
push dword [ebp + 0xc]
push eax
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 4]
pop esi
call fcn.01008e6b
leave
ret 8
Function at 0x1004fa6
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0xf6c], edi
push 6
pop ebx
je 0x1004fdd
cmp dword [esi + 0xf54], edi
je 0x1004fdd
mov eax, dword [esi]
push 0x124
push 2
push 0x10
push eax
call fcn.01003627
cmp eax, ebx
jne 0x100501b
push 2
push 0x40000000
mov ecx, esi
call fcn.010044d0
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x100500e
push 0x800
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x1005022
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 2
push 0x12
push dword [esi]
call fcn.01003627
xor eax, eax
jmp 0x100510b
mov eax, dword [esi + 4]
mov eax, dword [eax]
mov dword [edi], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x10]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x350]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x58]
push 4
mov dword [edi + 0x14], eax
lea eax, [esi + 0xf10]
pop ecx
mov edx, dword [eax]
mov dword [edi + ebx*4], edx
inc ebx
add eax, 4
dec ecx
jne 0x1005056
push 8
lea eax, [esi + 0xf20]
pop ecx
mov edx, dword [eax]
mov dword [edi + ebx*4], edx
inc ebx
add eax, 4
dec ecx
jne 0x100506b
and dword [ebp - 8], 0
push 0x28
pop eax
mov dword [ebp - 0xc], eax
mov ecx, dword [esi + 8]
mov ecx, dword [eax + ecx]
and dword [ebp - 4], 0
mov dword [edi + ebx*4], ecx
mov ecx, dword [esi + 8]
mov ecx, dword [eax + ecx + 0x28]
inc ebx
mov dword [edi + ebx*4], ecx
mov ecx, dword [esi + 8]
inc ebx
cmp dword [eax + ecx], 0
jle 0x10050c3
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.01007ecf
mov dword [edi + ebx*4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0xc]
inc ebx
inc dword [ebp - 4]
mov edx, dword [ebp - 4]
cmp edx, dword [eax + ecx]
jl 0x10050a3
inc dword [ebp - 8]
add eax, 4
cmp eax, 0x50
mov dword [ebp - 0xc], eax
jl 0x1005081
mov eax, dword [esi + 0xf58]
shl ebx, 2
push 0
mov dword [ebx + edi], eax
lea eax, [ebp - 0x14]
push eax
add ebx, 4
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.01004f47
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1008fb2
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x60
push 0x1001648
call fcn.0100a170
mov edi, 0x94
mov eax, edi
call fcn.0100a2d0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x101306c], ecx
mov eax, dword [esi + 4]
mov dword [0x1013078], eax
mov edx, dword [esi + 8]
mov dword [0x101307c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x1013070], esi
cmp ecx, 2
je 0x1009012
or esi, 0x8000
mov dword [0x1013070], esi
shl eax, 8
add eax, edx
mov dword [0x1013074], eax
cmp word [0x1000000], 0x5a4d
jne 0x100904e
mov eax, dword [0x100003c]
lea eax, [eax + 0x1000000]
cmp dword [eax], 0x4550
jne 0x100904e
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x1009067
cmp ecx, 0x20b
je 0x1009054
and dword [ebp - 0x1c], 0
jmp 0x100907b
cmp dword [eax + 0x84], 0xe
jbe 0x100904e
xor ecx, ecx
cmp dword [eax + 0xf8], ecx
jmp 0x1009075
cmp dword [eax + 0x74], 0xe
jbe 0x100904e
xor ecx, ecx
cmp dword [eax + 0xe8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
push 0
call fcn.0100a112
pop ecx
test eax, eax
jne 0x10090a8
cmp dword [0x1013054], 1
jne 0x1009095
call fcn.010098ee
push 0x1c
call fcn.01009701
push 0xff
call fcn.01009560
pop ecx
pop ecx
and dword [ebp - 4], 0
call fcn.01009f42
test eax, eax
jge 0x10090bd
push 0x1b
call fcn.01008f83
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1013650], eax
call fcn.01009e15
mov dword [0x101304c], eax
call fcn.01009d6c
test eax, eax
jge 0x10090e3
push 8
call fcn.01008f83
pop ecx
call fcn.01009b12
test eax, eax
jge 0x10090f4
push 9
call fcn.01008f83
pop ecx
call fcn.010095ba
mov dword [ebp - 0x28], eax
test eax, eax
je 0x1009107
push eax
call fcn.01008f83
pop ecx
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.01009aa4
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x1009129
movzx eax, word [ebp - 0x40]
jmp 0x100912c
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push 0
push 0x1000000
call fcn.010070c0
mov esi, eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x1c], 0
jne 0x100914d
push esi
call fcn.0100969a
call fcn.010096d2
jmp 0x100917f
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x7c]
call fcn.0100a1ab
ret
Function at 0x1009701
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x101107c]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x10110b0]
je 0x100972b
inc eax
cmp eax, 0x12
jb 0x100971c
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x10110b0]
mov dword [ebp - 0x110], esi
jne 0x10098d6
mov eax, dword [0x1013054]
cmp eax, 1
je 0x10098a4
test eax, eax
jne 0x1009761
cmp dword [0x1011084], 1
je 0x10098a4
cmp ecx, 0xfc
je 0x10098d6
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100979c
push 5
pop ecx
mov esi, 0x1001a1c
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebx, [ebp - 0x10c]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10097a7
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x10097df
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10097bf
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x1001a18
push ebx
call fcn.0100b6b0
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10097e4
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x110]
mov eax, dword [eax + 0x10110b4]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10097fe
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.0100a2d0
mov edx, esp
push 6
pop ecx
mov esi, 0x10019fc
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100982a
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1009836
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100984f
mov eax, dword [ebp - 0x110]
mov esi, 0x10019f8
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 0x10110b4]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100986d
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1009879
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x10019d0
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.0100b5a7
add esp, 0xc
jmp 0x10098d6
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x10098d6
mov esi, dword [esi + 0x10110b4]
mov ecx, esi
lea edx, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x10098bb
push 0
sub ecx, edx
lea edx, [ebp - 0x114]
push edx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x120]
mov ecx, dword [ebp - 4]
call fcn.01008e6b
pop edi
pop esi
pop ebx
leave
ret