joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007661
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x100c2c4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xa8], 0
cmp dword [0x100c5e4], 0xfffffffe
mov dword [ebp - 0xb0], 0xc
jne 0x1007786
and dword [0x100c5e4], 0
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1007786
cmp dword [ebp - 0x94], 1
jne 0x1007786
cmp dword [ebp - 0xa0], 4
jne 0x1007786
cmp dword [ebp - 0x9c], 0xa
jae 0x1007786
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1007786
lea eax, [ebp - 0xac]
push eax
push 0x20019
push 0
push 0x10015bc
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1007786
push edi
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xb4]
push eax
push 0
push 0x10012e1
push dword [ebp - 0xac]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xac]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x1007786
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0100753e
test eax, eax
je 0x1007786
and dword [ebp - 0xa8], 0x3ff
cmp dword [ebp - 0xa8], 1
je 0x100777c
cmp dword [ebp - 0xa8], 0xd
jne 0x1007786
mov dword [0x100c5e4], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x100c5e4]
xor ecx, ebp
call fcn.01006b07
leave
ret

Function at 0x10077f7
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0100779c

Function at 0x1008bc3
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x1008c04
push ebx
movzx edx, byte [ecx]
dec eax
inc ecx
movzx ebx, byte [ecx]
shl ebx, 8
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
test eax, eax
jg 0x1008bdd
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x1008c22
dec esi
je 0x1008c19
dec esi
jne 0x1008c27
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
movzx edx, byte [ecx]
shl edx, 8
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x40145e
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0
sub esp, 0x20
mov eax, 1
mov dword [ebp - 0xc], 1
mov eax, 0x100
shl eax, 2
push eax
call dword [sym.imp.MSVCRT.DLL_malloc]
add esp, 4
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
xchg edx, eax
mov eax, dword [ebp - 0x14]
mov dword [eax], edx
jmp 0x401503
mov esi, dword [ebp - 0x1c]
mov al, byte [esi]
cmp al, 0x20
jne 0x4014e3
mov al, 0
xchg edx, eax
mov esi, dword [ebp - 0x1c]
mov byte [esi], dl
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp - 0x1c]
mov al, byte [esi]
cmp al, 0x20
je 0x4014ac
mov esi, dword [ebp - 0x1c]
mov al, byte [esi]
cmp al, 0
jne 0x4014ce
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
jmp 0x4014e3
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
xchg edx, eax
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0xc]
dec edi
mov dword [eax + edi*4], edx
mov esi, dword [ebp - 0x1c]
mov al, byte [esi]
cmp al, 0x22
jne 0x4014fc
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp - 0x1c]
mov al, byte [esi]
cmp al, 0x22
jne 0x4014ec
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp - 0x1c]
mov al, byte [esi]
cmp al, 0
jne 0x40149b
mov eax, dword [ebp - 0xc]
xchg edx, eax
mov eax, dword [0x40301c]
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
mov eax, 0
xchg edx, eax
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0xc]
dec edi
mov dword [eax + edi*4], edx
mov eax, dword [ebp - 0x14]
xchg edx, eax
mov eax, dword [0x40301c]
mov dword [eax + 4], edx
mov eax, 0
xchg edx, eax
mov eax, dword [0x40301c]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x14]
xchg edx, eax
mov eax, dword [0x403048]
mov dword [eax], edx
leave
ret
Function at 0x401752
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
sub esp, 4
mov eax, 0
mov edx, dword [ebp + 8]
cmp eax, edx
je 0x40176a
xor eax, eax
jmp 0x40176d
xor eax, eax
inc eax
xor al, 1
cmp eax, 0
je 0x401b18
push 0
push 0x403137
push 6
push 0
push dword [ebp + 8]
push 2
push 0
push 0x40313a
push 6
push 0
push dword [0x403016]
push 3
push 0x30
lea esi, [esp + 4]
push esi
push 4
call fcn.0040170f
mov eax, dword [ebp + 8]
cmp eax, 1
je 0x401970
cmp eax, 2
je 0x40197a
cmp eax, 3
je 0x401984
cmp eax, 4
je 0x40198e
cmp eax, 5
je 0x401998
cmp eax, 6
je 0x4019a2
cmp eax, 7
je 0x4019ac
cmp eax, 8
je 0x4019b6
cmp eax, 9
je 0x4019c0
cmp eax, 0xa
je 0x4019ca
cmp eax, 0xb
je 0x4019d4
cmp eax, 0xc
je 0x4019de
cmp eax, 0xd
je 0x4019e8
cmp eax, 0xe
je 0x4019f2
cmp eax, 0xf
je 0x4019fc
cmp eax, 0x10
je 0x401a06
cmp eax, 0x11
je 0x401a10
cmp eax, 0x12
je 0x401a1a
cmp eax, 0x13
je 0x401a24
cmp eax, 0x14
je 0x401a2e
cmp eax, 0x15
je 0x401a38
cmp eax, 0x16
je 0x401a42
cmp eax, 0x17
je 0x401a49
cmp eax, 0x18
je 0x401a50
cmp eax, 0x19
je 0x401a57
cmp eax, 0x1a
je 0x401a5e
cmp eax, 0x1b
je 0x401a65
cmp eax, 0x1c
je 0x401a6c
cmp eax, 0x1d
je 0x401a73
cmp eax, 0x1e
je 0x401a7a
cmp eax, 0x1f
je 0x401a81
cmp eax, 0x20
je 0x401a88
cmp eax, 0x21
je 0x401a8f
cmp eax, 0x22
je 0x401a96
cmp eax, 0x60
je 0x401a9d
cmp eax, 0x61
je 0x401aa4
cmp eax, 0x62
je 0x401aab
cmp eax, 0x63
je 0x401ab2
cmp eax, 0x64
je 0x401ab9
cmp eax, 0x65
je 0x401ac0
mov eax, 0x40346d
jmp 0x401ac5
mov eax, 0x40314d
jmp 0x401ac5
mov eax, 0x40315e
jmp 0x401ac5
mov eax, 0x403170
jmp 0x401ac5
mov eax, 0x40317b
jmp 0x401ac5
mov eax, 0x403187
jmp 0x401ac5
mov eax, 0x403197
jmp 0x401ac5
mov eax, 0x4031ad
jmp 0x401ac5
mov eax, 0x4031c2
jmp 0x401ac5
mov eax, 0x4031d7
jmp 0x401ac5
mov eax, 0x4031ef
jmp 0x401ac5
mov eax, 0x4031fe
jmp 0x401ac5
mov eax, 0x403210
jmp 0x401ac5
mov eax, 0x403220
jmp 0x401ac5
mov eax, 0x403237
jmp 0x401ac5
mov eax, 0x403248
jmp 0x401ac5
mov eax, 0x40325f
jmp 0x401ac5
mov eax, 0x403277
jmp 0x401ac5
mov eax, 0x40328b
jmp 0x401ac5
mov eax, 0x4032a5
jmp 0x401ac5
mov eax, 0x4032bd
jmp 0x401ac5
mov eax, 0x4032d1
jmp 0x401ac5
mov eax, 0x4032dc
jmp 0x401ac5
mov eax, 0x4032eb
jmp 0x401ac5
mov eax, 0x4032fb
jmp 0x401ac5
mov eax, 0x403313
jmp 0x401ac5
mov eax, 0x403320
jmp 0x401ac5
mov eax, 0x403332
jmp 0x401ac5
mov eax, 0x403350
jmp 0x401ac5
mov eax, 0x40336f
jmp 0x401ac5
mov eax, 0x403391
jmp 0x401ac5
mov eax, 0x4033b3
jmp 0x401ac5
mov eax, 0x4033c7
jmp 0x401ac5
mov eax, 0x4033da
jmp 0x401ac5
mov eax, 0x4033e4
jmp 0x401ac5
mov eax, 0x4033ee
jmp 0x401ac5
mov eax, 0x40340c
jmp 0x401ac5
mov eax, 0x40341a
jmp 0x401ac5
mov eax, 0x40342b
jmp 0x401ac5
mov eax, 0x403439
jmp 0x401ac5
mov eax, 0x403452
mov dword [ebp - 8], eax
push 0
push dword [ebp - 8]
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.0040170f
push 0
push dword [0x403016]
push 3
push 0
push 0x403481
push 6
push 0
push dword [ebp + 0xc]
push 7
push 0
push 0x403483
push 6
push 0
push dword [0x403016]
push 3
push 0x3c
lea esi, [esp + 4]
push esi
push 5
call fcn.0040170f
call fcn.0040155b
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
leave
ret 8
Function at 0x401060
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x28
mov dword [ebp - 0x18], eax
mov eax, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp], 0x1000
mov dword [ebp - 0x1c], eax
call eax
mov ebx, dword [0x407004]
mov dword [ebp - 0x10], 0x1000
mov ecx, eax
jmp 0x4010b8
mov eax, ebx
add ebx, 1
movzx edx, byte [eax + section..bss]
mov dword [0x407004], ebx
cmp dl, 0xa
je 0x4011d1
lea edi, [esi + 1]
cmp edi, dword [ebp - 0x10]
jge 0x401110
mov byte [ecx + esi], dl
mov esi, edi
cmp dword [0x407000], ebx
ja 0x401090
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x407000
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x406000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReadFile]
mov ecx, dword [ebp - 0x14]
sub esp, 0x14
test eax, eax
je 0x401130
mov eax, dword [0x407000]
test eax, eax
je 0x401130
mov ebx, 1
xor eax, eax
jmp 0x401095
shl dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
mov byte [ebp - 0x14], dl
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_realloc]
movzx edx, byte [ebp - 0x14]
mov ecx, eax
jmp 0x4010b3
test esi, esi
je 0x4011e2
mov byte [ecx + esi], 0
lea eax, [ecx + esi - 1]
cmp byte [eax], 0xd
jne 0x401148
mov byte [eax], 0
mov dword [esp + 8], ecx
mov esi, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [ebp - 0x10], ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 0x18
mov edi, eax
lea eax, [eax + eax]
mov dword [esp], eax
mov eax, dword [ebp - 0x1c]
call eax
mov ecx, dword [ebp - 0x10]
mov dword [esp + 0x14], edi
mov ebx, eax
mov dword [esp + 0x10], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
mov ecx, dword [ebp - 0x10]
sub esp, 0x18
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov byte [ecx + esi], 0
test esi, esi
je 0x401148
jmp 0x40113c
xor ebx, ebx
jmp 0x4011c7
Function at 0x4012a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov edx, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
cmp word [eax], 0
je 0x4013d0
add eax, 2
cmp word [eax], 0
jne 0x4012b5
sub eax, edx
sar eax, 1
mov ebx, eax
mov ecx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 8], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call ecx
sub esp, 0x20
mov esi, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [esp + 0x14], esi
mov edi, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 8], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call ecx
sub esp, 0x20
mov dword [esp], 0xfffffff5
call dword [sym.imp.kernel32.dll_GetStdHandle]
lea edx, [ebp - 0x10]
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
cmp dword [ebp - 0x10], esi
jae 0x401394
test byte [section..data], 2
jne 0x4013a5
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], str.Failed_to_write_output_n
mov dword [esp + 8], str.write_to_stdout
mov dword [esp + 4], 0x403000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.4
jmp 0x401394
xor ebx, ebx
jmp 0x4012c4

Function at 0x401aa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strlen]
mov esi, eax
xor eax, eax
test esi, esi
je 0x401af8
cmp byte [ebx + esi - 1], 0xa
je 0x401acc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4070a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x402110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call dbg.__wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x4022d4
mov edx, dword fs:[0x18]
xor eax, eax
mov edi, dword [0x4070a4]
cmp dword [edx + 0x24], edi
je 0x4021f7
test byte [0x403018], 8
jne 0x402280
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x403028], 8
jne 0x402243
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x402199
cmp esi, 3
jbe 0x402202
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x4021aa
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x405138]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.2
jmp 0x402199
mov dword [esp], 0x403028
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x402170
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x402170
mov dword [esp], 0x403018
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x40215b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x402163
mov eax, 0xffffffff
jmp 0x4021f7

Function at 0x402340
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov ebx, dword [eax]
call sym.___p___wargv
mov esi, dword [eax]
call sym.__get_initial_wide_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dbg.wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x10001d70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10017c40]
push ebx
push esi
push edi
push 0x104
mov dword [ebp - 0x124], eax
mov ebx, ecx
lea eax, [ebp - 0x110]
mov dword [ebp - 0x128], edx
push 0
push eax
call fcn.10007d50
add esp, 0xc
lea eax, [ebp - 0x120]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x120], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x112]
push eax
movzx eax, word [ebp - 0x114]
push eax
movzx eax, word [ebp - 0x116]
push eax
movzx eax, word [ebp - 0x118]
push eax
movzx eax, word [ebp - 0x11a]
push eax
movzx eax, word [ebp - 0x11e]
push eax
movzx eax, word [ebp - 0x120]
push eax
lea eax, [ebp - 0x110]
push str._04d__02d__02d__02d:_02d:_02d:_03d_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
mov esi, ebx
mov al, byte [ebx]
inc ebx
test al, al
jne 0x10001e16
lea edi, [ebp - 0x110]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10001e26
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x128]
lea ecx, [ebp - 0x110]
dec ecx
test esi, esi
je 0x10001e97
lea ecx, [ecx]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x10001e50
mov ax, word [0x10013fa8]
mov word [ecx], ax
mov al, byte [0x10013faa]
mov byte [ecx + 2], al
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001e74
sub ecx, edx
lea eax, [ebp - 0x110]
push esi
add eax, ecx
push str.error_code__0x_x__r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x10001eb2
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x10001e97
mov ax, word [0x10013f6c]
mov word [ecx], ax
mov al, byte [0x10013f6e]
mov byte [ecx + 2], al
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
jmp 0x10001ec0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001ec0
push 0
lea eax, [ebp - 0x12c]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100044fa
mov esp, ebp
pop ebp
ret
Function at 0x100020f0
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x100
lea eax, [ebp - 0x104]
mov dword [ebp - 0x128], ecx
push 0
push eax
call fcn.10007d50
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x130], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 4
mov dword [ebp - 0x12c], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x124], ebx
cmp ebx, 0xffffffff
je 0x10002256
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
jne 0x10002185
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100044fa
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.USER32.dll_FindWindowA]
push esi
mov esi, dword [ebp - 0x124]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x114], eax
jne 0x10002237
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x130]
je 0x10002237
push eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp dword [ebp - 0x128], 1
push eax
jne 0x100021dd
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x100021e3
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x100
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
test eax, eax
je 0x10002237
mov esi, 1
mov edi, edi
lea eax, [ebp - 0x104]
push eax
push 0
call ebx
test eax, eax
jne 0x1000221b
push 0x64
call edi
inc esi
cmp esi, 0x64
jl 0x10002200
jmp 0x10002231
cmp dword [ebp - 0x128], 1
jne 0x10002228
push 0
jmp 0x1000222a
push 1
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov esi, dword [ebp - 0x124]
lea eax, [ebp - 0x120]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x100021a0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100044fa
mov esp, ebp
pop ebp
ret

Function at 0x10002270
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
test dword [0x10017a8c], 0x200
mov eax, dword [0x10017c40]
je 0x10002290
test eax, eax
je 0x10002290
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
test eax, eax
je 0x100022b3
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x100022b9
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x10002820
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push 0x100
push 0
push 0x10017680
mov esi, ecx
call fcn.10007d50
add esp, 0xc
mov dword [0x10017980], 0
mov ecx, esi
mov dword [0x1001767c], 0
call fcn.10002690
test byte [0x10017678], 0xb
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextA]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
jne 0x1000287c
push 0
push 0x2725
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1000289d
push 1
push 0x2725
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x100163c8
push 0x2725
push esi
call edi
push eax
call ebx
push 0x10017880
push 0x3ec
push esi
call edi
push eax
call ebx
mov ecx, 0x10017578
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100028b5
sub ecx, edx
je 0x100028d2
push 0x10017578
push 0x3f1
push esi
call edi
push eax
call ebx
jmp 0x100028e3
push 0
push 0x3f1
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x100161c0
push 0x3ef
push esi
call edi
push eax
call ebx
push 0x100165c8
push 0x3f0
push esi
call edi
push eax
call ebx
push 0x100160c0
push 0x271b
push esi
call edi
push eax
call ebx
push 0x100164c8
push 0x2711
push esi
call edi
push eax
call ebx
push 0x100162c0
push esi
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x10002ad0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x100
push 0
push 0x10017578
call fcn.10007d50
mov eax, dword [0x10017c44]
mov ecx, 0x10017988
add esp, 0xc
mov dword [0x10017678], eax
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002b00
sub ecx, edx
je 0x10002b21
lea eax, [ecx + 1]
push eax
push 0x10017988
push 0x10017880
call fcn.1000b8e0
add esp, 0xc
mov ecx, 0x10017aa0
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002b30
sub ecx, edx
je 0x10002b51
lea eax, [ecx + 1]
push eax
push 0x10017aa0
push 0x10017780
call fcn.1000b8e0
add esp, 0xc
mov edx, dword [ebp + 0x14]
push esi
test edx, edx
je 0x10002b8b
mov ecx, edx
lea esi, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002b60
sub ecx, esi
je 0x10002b8b
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002b70
sub ecx, esi
lea eax, [ecx + 1]
push eax
push edx
push 0x10017578
call fcn.1000b8e0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
push eax
push 0x10002a90
movdqu xmmword [ebp - 0x18], xmm0
movq qword [ebp - 8], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0
neg eax
push 0x10002940
push 0
sbb eax, eax
and eax, dword [ebp - 0x18]
push 0x65
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 0xffffffff
jne 0x10002bd6
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [0x10017574]
cmp esi, 4
jne 0x10002c11
mov eax, dword [0x10017980]
inc eax
push eax
push 0x10017880
push 0x10017988
call fcn.1000b8e0
mov ecx, dword [0x1001767c]
inc ecx
push ecx
push 0x10017680
push 0x10017c48
call fcn.1000b8e0
add esp, 0x18
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret