joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005510
Capabilities:
Get file system object information

Disassembly:
push ebp
lea ebp, [esp - 0x2f8]
sub esp, 0x378
mov eax, dword [0x1001c4e0]
push ebx
push esi
push edi
mov dword [ebp + 0x2f4], eax
mov esi, ecx
call dword [0x1001c090]
mov edi, dword [0x1001df14]
mov dword [ebp - 0x80], eax
push 0x104
lea eax, [ebp + 0xe8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1000555e
call fcn.10001410
jmp 0x100056b8
cmp eax, 0x104
jne 0x1000556f
mov eax, 0x8007007a
jmp 0x100056b8
test edi, edi
je 0x10005593
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp edi, eax
je 0x10005593
mov ecx, dword [esi]
lea edx, [ebp + 0xe8]
push edx
push str.Module
push esi
call dword [ecx + 0x14]
jmp 0x100055dd
lea eax, [ebp + 0xe8]
push eax
lea ecx, [ebp + 0x1ed]
mov bl, 0x22
push ecx
mov byte [ebp + 0x1ec], bl
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp + 0x1ec]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp + 0x1ec]
push ecx
push str.Module
mov byte [ebp + eax + 0x1ec], bl
mov byte [ebp + eax + 0x1ed], 0
mov eax, dword [esi]
push esi
call dword [eax + 0x14]
test eax, eax
jl 0x100056b8
mov edx, dword [esi]
lea eax, [ebp + 0xe8]
push eax
push str.Module_Raw
push esi
call dword [edx + 0x14]
test eax, eax
jl 0x100056b8
lea ecx, [ebp - 0x7c]
push ecx
push 0x1001d360
call dword [sym.imp.ole32.dll_StringFromCLSID]
test eax, eax
jl 0x100056b8
mov eax, dword [ebp - 0x7c]
test eax, eax
mov ebx, eax
je 0x10005645
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.1000c960
mov edx, dword [ebp - 0x80]
mov eax, esp
push edx
push edi
push ebx
push eax
call fcn.10001200
mov ecx, dword [esi]
push eax
push str.MODULEGUID
push esi
call dword [ecx + 0x14]
mov edx, dword [ebp - 0x7c]
push edx
mov edi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test edi, edi
jge 0x10005665
mov eax, edi
jmp 0x100056b8
push 0x2000
push 0x160
lea eax, [ebp - 0x78]
push eax
push 0
lea ecx, [ebp + 0xe8]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
jne 0x10005698
mov edx, dword [esi]
push str.InprocServer32
push str.MODULETYPE
push esi
call dword [edx + 0x14]
jmp 0x100056a8
mov eax, dword [esi]
push str.LocalServer32
push str.MODULETYPE
push esi
call dword [eax + 0x14]
test eax, eax
jl 0x100056b8
mov ecx, dword [0x1001d370]
mov edx, dword [ecx]
push esi
call dword [edx + 0x14]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x2f4]
call fcn.1000c9ce
pop edi
pop esi
pop ebx
add ebp, 0x2f8
mov esp, ebp
pop ebp
ret
Function at 0x100080a3
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x1001c4e0]
push esi
mov dword [ebp - 4], eax
xor esi, esi
xor eax, eax
cmp dword [ebp + 0xc], esi
je 0x10008143
push edi
push 0x49
pop ecx
push esi
mov dword [ebp - 0x12c], esi
lea edi, [ebp - 0x128]
push 2
rep stosd dword es:[edi], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x100080e7
xor eax, eax
jmp 0x10008142
lea eax, [ebp - 0x12c]
push eax
push edi
mov dword [ebp - 0x12c], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10008139
push dword [ebp + 0xc]
call fcn.1000de88
pop ecx
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.1000de88
pop ecx
push eax
call fcn.1000de00
test eax, eax
pop ecx
pop ecx
je 0x1000814e
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10008102
xor esi, esi
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
mov ecx, dword [ebp - 4]
pop esi
call fcn.1000c9ce
leave
ret
push dword [ebp - 0x124]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push dword [ebp + 8]
push 0xf01ff
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, eax
jmp 0x10008139

Function at 0x10008173
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1001c4e0]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
inc eax
cmp dword [ebp - 0x88], eax
jne 0x100081b8
cmp dword [ebp - 0x94], 4
jne 0x100081b8
cmp dword [ebp - 0x90], 0xa
je 0x100081ba
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.1000c9ce
leave
ret

Function at 0x100081c4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x1001c4e0]
push esi
xor esi, esi
push esi
push esi
push esi
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x6c]
push eax
push 0xc
push esi
push 0x10017bc4
mov dword [ebp - 0x6c], esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
push 0x10017bc0
push eax
call fcn.1000e148
lea eax, [ebp - 0x68]
push eax
call fcn.1000da10
add esp, 0x10
test eax, eax
jne 0x1000822a
push str.oft_lock
push str.micros
lea eax, [ebp - 0x68]
push str._s_s
push eax
call fcn.1000e148
add esp, 0x10
lea eax, [ebp - 0x68]
push eax
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp eax, esi
je 0x10008248
xor esi, esi
push eax
inc esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
call fcn.1000c9ce
leave
ret
Function at 0x10008817
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x1001c4e0]
push ebx
push esi
xor ebx, ebx
push str.shell32.dll
mov dword [ebp + 0x8c], eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x78], bl
mov byte [ebp - 0x79], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
je 0x10008881
push str.SHGetFolderPathA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x10008875
lea ecx, [ebp - 0x78]
push ecx
push ebx
push ebx
push dword [ebp + 0x9c]
push ebx
call eax
test eax, eax
jl 0x10008875
mov byte [ebp - 0x79], 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [ebp - 0x79], bl
jne 0x10008890
push 0x104
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [ebp + 0x98]
lea eax, [ebp - 0x78]
push eax
call fcn.10004bc0
mov ecx, dword [ebp + 0x8c]
mov eax, dword [ebp + 0x98]
pop esi
pop ebx
call fcn.1000c9ce
add ebp, 0x90
leave
ret 8

Function at 0x100088bc
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x10015ec9
call fcn.1000dde0
sub esp, 0x430
mov eax, dword [0x1001c4e0]
push ebx
push esi
push edi
lea ecx, [ebp - 0x430]
mov dword [ebp - 0x10], eax
xor ebx, ebx
xor esi, esi
call fcn.1000a8f8
xor eax, eax
mov byte [ebp - 0x42c], bl
mov ecx, 0xff
lea edi, [ebp - 0x42b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x22
stosb byte es:[edi], al
lea eax, [ebp - 0x42c]
push str.__f4to_JMQ_iO0gmW
push eax
mov dword [ebp - 4], ebx
call fcn.1000daa0
add esp, 0xc
push 0x10017b8c
push 0x22
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x430]
call fcn.1000a908
push dword [ebp + 8]
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.100087c5
mov eax, dword [ebp - 0x28]
add esp, 0xc
cmp dword [ebp - 0x14], 0x10
jae 0x10008952
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x434]
push ecx
push 0xf003f
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100089c0
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x438]
push eax
push ebx
push str.Start
push dword [ebp - 0x434]
mov dword [ebp + 8], 0x50
mov dword [ebp - 0x438], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100089b4
cmp dword [ebp - 0x43c], 2
jne 0x100089b4
xor esi, esi
inc esi
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.10002350
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x430]
call fcn.1000a901
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.1000c9ce
leave
ret 4
Function at 0x10008a4e
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x10015ee3
call fcn.1000dde0
sub esp, 0x54
push ebx
push esi
push edi
push 0x44
pop edi
push edi
xor esi, esi
xor ebx, ebx
lea eax, [ebp - 0x60]
push esi
inc ebx
push eax
mov dword [ebp - 4], ebx
call fcn.1000dfa0
push 0x10
lea eax, [ebp - 0x1c]
push esi
push eax
mov dword [ebp - 0x60], edi
call fcn.1000dfa0
add esp, 0x18
push 0x10017bf8
lea ecx, [ebp + 8]
call fcn.1000862c
push 0xffffffffffffffff
push esi
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp + 8]
call fcn.100084d1
cmp dword [ebp + 0x20], 0x10
mov eax, dword [ebp + 0xc]
jae 0x10008aae
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x60]
push ecx
push esi
push esi
push 0x8000000
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10008aea
push 0x927c0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x18]
call edi
push esi
lea ecx, [ebp + 8]
push ebx
call fcn.10002350
push esi
lea ecx, [ebp + 0x24]
push ebx
call fcn.10002350
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x38
Function at 0x1000a4fa
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
xor esi, esi
push 0xf003f
push esi
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, esi
mov dword [ebp - 4], eax
je 0x1000a57e
push ebx
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x18], 0x10
jb 0x1000a52d
mov eax, dword [edi + 4]
jmp 0x1000a530
lea eax, [edi + 4]
push 0xf01ff
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
cmp ebx, esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x1000a577
lea eax, [ebp - 0x28]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1000a574
cmp dword [ebp - 0x24], 4
jne 0x1000a574
mov ecx, dword [ebp - 0xc]
push edi
call fcn.100088bc
test eax, eax
je 0x1000a574
mov dword [ebp - 8], 1
push ebx
call esi
push dword [ebp - 4]
call esi
pop edi
pop ebx
mov eax, dword [ebp - 8]
pop esi
leave
ret 4

Function at 0x1000a5e1
Capabilities:
Copy file

Disassembly:
mov eax, 0x10016518
call fcn.1000dde0
sub esp, 0x3c
mov eax, dword [0x1001c4e0]
push esi
push edi
xor edi, edi
push edi
mov dword [ebp - 0x10], eax
mov esi, ecx
call fcn.10008c3f
lea eax, [esi + 0x1c]
push eax
lea ecx, [ebp - 0x48]
call fcn.10004300
add esi, 0xa8
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.10004300
cmp dword [ebp - 0x30], 0x10
mov ecx, dword [ebp - 0x44]
jae 0x1000a62c
lea ecx, [ebp - 0x44]
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x1000a638
lea eax, [ebp - 0x28]
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.10002350
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.10002350
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
call fcn.1000c9ce
leave
ret
Function at 0x1000a66d
Capabilities:
Copy file
Set file attributes

Disassembly:
mov eax, 0x10016542
call fcn.1000dde0
sub esp, 0x48
mov eax, dword [0x1001c4e0]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor edi, edi
push edi
mov dword [ebp - 0x14], eax
mov esi, ecx
call fcn.10008c3f
lea eax, [esi + 0x54]
push eax
lea ecx, [ebp - 0x30]
call fcn.10004300
lea eax, [esi + 0xe0]
push eax
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], edi
call fcn.10004300
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 1
jae 0x1000a6c0
lea eax, [ebp - 0x2c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [ebp - 0x18], 0x10
mov ecx, dword [ebp - 0x2c]
jae 0x1000a6d8
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x34], 0x10
mov eax, dword [ebp - 0x48]
jae 0x1000a6e4
lea eax, [ebp - 0x48]
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x1000a766
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x54], esp
push 0x10017cf8
mov byte [ebp - 4], 2
call fcn.10004bc0
sub esp, 0x1c
lea eax, [ebp - 0x30]
mov ecx, esp
mov dword [ebp - 0x50], esp
push eax
mov byte [ebp - 4], 3
call fcn.10004300
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.10008a4e
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x50], esp
push 0x10017cf4
call fcn.10004bc0
sub esp, 0x1c
lea eax, [ebp - 0x30]
mov ecx, esp
mov dword [ebp - 0x54], esp
push eax
mov byte [ebp - 4], 4
call fcn.10004300
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.10008a4e
xor esi, esi
inc esi
jmp 0x1000a768
xor esi, esi
push edi
push 1
lea ecx, [ebp - 0x4c]
call fcn.10002350
push edi
push 1
lea ecx, [ebp - 0x30]
call fcn.10002350
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.1000c9ce
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000a908
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x1000a94b
cmp byte [edi], 0
je 0x1000a94b
push ebx
push edi
call fcn.1000da10
pop ecx
xor ecx, ecx
cmp dword [esp + 0x10], ecx
mov ebx, eax
jle 0x1000a946
push esi
mov eax, dword [esp + 0x10]
lea esi, [ecx + eax]
mov eax, ecx
cdq
idiv ebx
mov al, byte [esi]
sub al, cl
xor al, byte [edx + edi]
inc ecx
cmp ecx, dword [esp + 0x14]
mov byte [esi], al
jl 0x1000a929
pop esi
mov al, 1
pop ebx
jmp 0x1000a94d
xor al, al
pop edi
ret 0xc

Function at 0x1000aa16
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x58], eax
ret
Function at 0x1000c060
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x1001c4e0]
push esi
mov dword [ebp + 0x74], eax
mov esi, ecx
call fcn.1000bfe2
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.1000dfa0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x1000c0c2
cmp dword [ebp - 0x1c], 5
jb 0x1000c0da
jmp 0x1000c0d6
cmp dword [ebp - 0x10], 1
jne 0x1000c0da
cmp dword [ebp - 0x1c], 4
ja 0x1000c0d6
jne 0x1000c0da
cmp dword [ebp - 0x18], 0
jbe 0x1000c0da
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x710
mov dword [esi + 0x14], 0x10017e1c
call fcn.100012b0
test eax, eax
jge 0x1000c0fb
mov byte [0x1001d37c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
pop esi
call fcn.1000c9ce
add ebp, 0x78
leave
ret

Function at 0x1000c67e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.1000c960
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1000c719
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x1001e25c]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x1000c719
cmp eax, 1
je 0x1000c73a
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1000c719
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x1000c6e6
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x1000c715
xor eax, eax
inc eax
jmp 0x1000c759
cmp edi, eax
jae 0x1000c71d
xor eax, eax
jmp 0x1000c759
cmp eax, esi
jae 0x1000c724
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x1001e25c]
jmp 0x1000c73d
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000d6b2
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x1000d7a2
mov eax, 0x94
call fcn.1000c960
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1000d817
mov ecx, dword [esi + 0x10]
mov dword [0x1001e25c], ecx
mov eax, dword [esi + 4]
mov dword [0x1001e268], eax
mov edx, dword [esi + 8]
mov dword [0x1001e26c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x1001e260], esi
je 0x1000d71d
or esi, 0x8000
mov dword [0x1001e260], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x1001e264], eax
call fcn.1000fa52
test eax, eax
pop ecx
je 0x1000d817
call fcn.100113a2
test eax, eax
jne 0x1000d74a
call fcn.1000faa3
jmp 0x1000d817
call fcn.10011cbe
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1001f958], eax
call fcn.10011b9c
mov dword [0x1001e0d4], eax
call fcn.1001167d
test eax, eax
jl 0x1000d79b
call fcn.10011afa
test eax, eax
jl 0x1000d796
call fcn.100118c7
test eax, eax
jl 0x1000d796
push 0
call fcn.1001069f
test eax, eax
pop ecx
jne 0x1000d796
inc dword [0x1001e0d0]
jmp 0x1000d828
call fcn.1001187b
call fcn.1001118b
jmp 0x1000d740
test eax, eax
jne 0x1000d7d2
cmp dword [0x1001e0d0], eax
jle 0x1000d817
dec dword [0x1001e0d0]
cmp dword [0x1001e298], eax
jne 0x1000d7c1
call fcn.100107dd
call fcn.1001187b
call fcn.1001118b
call fcn.1000faa3
jmp 0x1000d828
cmp eax, 2
jne 0x1000d81b
push 0x8c
push 1
call fcn.100115c2
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x1000d817
push esi
push dword [0x1001ca88]
call dword [0x1001e300]
test eax, eax
push esi
je 0x1000d811
call fcn.100111a8
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x1000d828
call fcn.1000c60d
pop ecx
xor eax, eax
jmp 0x1000d82b
cmp eax, 3
jne 0x1000d828
push 0
call fcn.10011373
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc

Function at 0x1000e000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1000e020
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1000f103
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x1000e043
test byte [esp + 8], 2
je 0x1000e043
call fcn.1000f0f1
mov dword [eax], 0xd
call fcn.1000f0fa
mov dword [eax], 5
jmp 0x1000e01c
xor eax, eax
ret
Function at 0x10010709
Capabilities:
Terminate process

Disassembly:
push 8
push 0x10018718
call fcn.1000e944
push 8
call fcn.1000eef4
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x1001e29c], esi
jne 0x1001073d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x1001e298], esi
mov al, byte [ebp + 0x10]
mov byte [0x1001e294], al
cmp dword [ebp + 0xc], edi
jne 0x10010787
cmp dword [0x1001f928], edi
je 0x10010777
mov eax, dword [0x1001f924]
sub eax, 4
mov dword [0x1001f924], eax
cmp eax, dword [0x1001f928]
jb 0x10010777
mov eax, dword [eax]
cmp eax, edi
je 0x10010758
call eax
jmp 0x10010758
push 0x1001c080
mov eax, 0x1001c078
call fcn.10010687
pop ecx
push 0x1001c08c
mov eax, 0x1001c084
call fcn.10010687
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x100107b8
cmp dword [ebp + 0x10], edi
jne 0x100107c6
mov dword [0x1001e29c], esi
push dword [ebp + 8]
call fcn.10010645
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x100107c5
push 8
call fcn.1000ee3f
pop ecx
ret
call fcn.1000e97f
ret
Function at 0x10011ec5
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x1001c4e0]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x1001cb40]
je 0x10011efa
inc eax
cmp eax, 0x13
jb 0x10011eeb
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x1001cb40]
jne 0x10012020
mov eax, dword [0x1001e0dc]
cmp eax, 1
je 0x10011ff8
cmp eax, edx
jne 0x10011f2a
cmp dword [0x1001e0e0], 1
je 0x10011ff8
cmp ecx, 0xfc
je 0x10012020
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10011f60
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.1000e050
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.1000da10
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10011f94
mov eax, edi
push eax
call fcn.1000da10
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x1001875c
push edi
call fcn.1000e640
add esp, 0x10
push edi
call fcn.1000da10
push dword [esi + 0x1001cb44]
mov ebx, eax
call fcn.1000da10
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.1000c960
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.1000e050
push edi
push ebx
call fcn.1000e060
push 0x10018758
push ebx
call fcn.1000e060
push dword [esi + 0x1001cb44]
push ebx
call fcn.1000e060
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.10013dd7
add esp, 0x2c
jmp 0x10012020
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x1001cb44]
push dword [esi]
call fcn.1000da10
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.1000c9ce
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x10013dd7
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x1001e4b8], ebx
push esi
push edi
jne 0x10013e57
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10013e92
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x1001e4b8], eax
je 0x10013e92
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x1001e4bc], eax
call esi
cmp dword [0x1001e25c], 2
mov dword [0x1001e4c0], eax
jne 0x10013e57
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x1001e4c8], eax
je 0x10013e57
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x1001e4c4], eax
mov eax, dword [0x1001e4c4]
test eax, eax
je 0x10013e9c
call eax
test eax, eax
je 0x10013e83
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x1001e4c8]
test eax, eax
je 0x10013e83
test byte [ebp - 8], 1
jne 0x10013e9c
cmp dword [0x1001e268], 4
jb 0x10013e96
or byte [ebp + 0x12], 0x20
jmp 0x10013ebb
xor eax, eax
jmp 0x10013ecb
or byte [ebp + 0x12], 4
jmp 0x10013ebb
mov eax, dword [0x1001e4bc]
test eax, eax
je 0x10013ebb
call eax
mov ebx, eax
test ebx, ebx
je 0x10013ebb
mov eax, dword [0x1001e4c0]
test eax, eax
je 0x10013ebb
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x1001e4b8]
pop edi
pop esi
pop ebx
leave
ret