joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d06f7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d8dfc]
jne 0x5d0701
repz ret
jmp fcn.005d9f2f

Function at 0x5d091e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x5d094f
call fcn.005d7a6a
mov dword [eax], esi
call fcn.005d7a57
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.005d1956
add esp, 0x14
push 0x16
pop eax
jmp 0x5d09a4
test dword [ebp + 0xc], 0xfffffff9
jne 0x5d092b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5d097c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005d7a7d
pop ecx
call fcn.005d7a57
mov eax, dword [eax]
jmp 0x5d09a4
test al, 0x10
jne 0x5d09a2
test al, 1
je 0x5d09a2
test byte [ebp + 0xc], 2
je 0x5d09a2
call fcn.005d7a6a
mov dword [eax], 5
call fcn.005d7a57
mov dword [eax], 0xd
jmp 0x5d0973
xor eax, eax
pop esi
pop ebp
ret

Function at 0x5e53b4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.005da0a7
and dword [ebp - 4], 0
cmp dword [0x783fb8], 0
mov ebx, eax
jne 0x5e5465
push 0x699780
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5e5516
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x699774
push edi
call esi
test eax, eax
je 0x5e5516
push eax
call fcn.005da035
mov dword [esp], 0x699764
push edi
mov dword [0x783fb8], eax
call esi
push eax
call fcn.005da035
mov dword [esp], 0x699750
push edi
mov dword [0x783fbc], eax
call esi
push eax
call fcn.005da035
mov dword [esp], 0x699734
push edi
mov dword [0x783fc0], eax
call esi
push eax
call fcn.005da035
pop ecx
mov dword [0x783fc8], eax
test eax, eax
je 0x5e5465
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.005da035
pop ecx
mov dword [0x783fc4], eax
mov eax, dword [0x783fc4]
cmp eax, ebx
je 0x5e54bd
cmp dword [0x783fc8], ebx
je 0x5e54bd
push eax
call fcn.005da0b0
push dword [0x783fc8]
mov esi, eax
call fcn.005da0b0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5e54bd
test edi, edi
je 0x5e54bd
call esi
test eax, eax
je 0x5e54b4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5e54b4
test byte [ebp - 0xc], 1
jne 0x5e54bd
or dword [ebp + 0x10], 0x200000
jmp 0x5e54f6
mov eax, dword [0x783fbc]
cmp eax, ebx
je 0x5e54f6
push eax
call fcn.005da0b0
pop ecx
test eax, eax
je 0x5e54f6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5e54f6
mov eax, dword [0x783fc0]
cmp eax, ebx
je 0x5e54f6
push eax
call fcn.005da0b0
pop ecx
test eax, eax
je 0x5e54f6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x783fb8]
call fcn.005da0b0
pop ecx
test eax, eax
je 0x5e5516
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5e5518
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5effb0
Capabilities:
Get common file path

Disassembly:
push ebp
push esi
push edi
xor edi, edi
test ebx, ebx
je 0x5f002b
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
push edi
call ebp
push ebx
mov esi, eax
call fcn.005eeba2
add eax, esi
add esp, 4
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x5effe7
pop edi
pop esi
pop ebp
ret
push esi
push edi
call ebp
mov ebp, eax
cmp word [edi + ebp*2 - 2], 0x5c
je 0x5efffe
mov word [edi + ebp*2], 0x5c
add ebp, 1
push ebx
xor esi, esi
call fcn.005eeba2
add esp, 4
test eax, eax
jbe 0x5f002b
lea ebp, [edi + ebp*2]
mov cx, word [ebx + esi*2]
mov word [ebp], cx
push ebx
add esi, 1
add ebp, 2
call fcn.005eeba2
add esp, 4
cmp esi, eax
jb 0x5f0010
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x5f1160
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x14
push ebp
mov ebp, dword [esp + 0x1c]
push esi
xor esi, esi
cmp dword [0x7845e8], esi
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x24
mov dword [esp + 0x14], 0x26
mov dword [esp + 0x18], 0x2a
jne 0x5f11f6
push 3
push 0x20
push 3
push 1
push 3
push 2
push esi
push esi
call sub.KERNEL32.dll_VerSetConditionMask
push edx
push eax
call sub.KERNEL32.dll_VerSetConditionMask
push edx
push eax
call sub.KERNEL32.dll_VerSetConditionMask
push edx
push eax
push 0x23
push 0x7845e8
mov dword [0x7845e8], 0x11c
mov dword [0x7845ec], 6
mov dword [0x7845f0], 1
mov word [0x7846fc], si
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
neg eax
sbb eax, eax
add eax, 1
mov dword [0x6da2c4], eax
jmp 0x5f11fb
mov eax, dword [0x6da2c4]
cmp eax, esi
je 0x5f120a
pop esi
mov eax, 1
pop ebp
add esp, 0x14
ret
cmp ebp, esi
je 0x5f132a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push edi
push esi
push esi
push esi
push ebp
call ebx
mov edi, eax
test edi, edi
je 0x5f1328
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [esp + 0x10], eax
je 0x5f1328
push 0
mov ecx, eax
push ecx
push edi
push ebp
call ebx
cmp edi, eax
jbe 0x5f1328
mov ebp, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ebx, ebx
jmp 0x5f1260
mov eax, dword [esp + ebx*4 + 0x18]
cmp eax, 0x26
jne 0x5f12df
push 0
push 0
push str._ProgramW6432_
call ebp
mov edi, eax
test edi, edi
je 0x5f1328
lea edx, [edi + edi + 2]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x5f1328
push edi
push esi
push str._ProgramW6432_
call ebp
cmp edi, eax
jne 0x5f1328
push esi
push str._ProgramW6432_
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x5f12c6
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x682a5c
push 0x26
jmp 0x5f12e5
cmp word [esi + edi*2 - 4], 0x5c
je 0x5f12f3
push 0x6a3d48
add edi, 1
push edi
push esi
call fcn.005f0fb0
jmp 0x5f12f3
push 0x682a5c
push eax
call fcn.005f1050
mov esi, eax
add esp, 8
test esi, esi
je 0x5f1328
push esi
call fcn.005eeba2
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
call fcn.005f23d4
add esp, 0x10
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x14], eax
jne 0x5f1328
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
add ebx, 1
xor esi, esi
cmp ebx, 3
jl 0x5f1260
pop edi
pop ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
mov eax, dword [esp + 0xc]
pop esi
pop ebp
add esp, 0x14
ret

Function at 0x5f16d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push eax
mov eax, dword [esp + 0xc]
call fcn.005f1560
mov esi, eax
add esp, 4
test esi, esi
je 0x5f1712
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x5f16f4
test al, 0x50
je 0x5f1712
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x5f1707
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop esi
ret
mov eax, esi
pop esi
ret
Function at 0x1001514e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100151bd
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push dword [eax]
mov eax, dword [ebp - 0x1c]
push dword [eax]
lea eax, [ebp - 0x44]
push eax
call fcn.10012ce8
add esp, 0x10
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
call fcn.10016883
lea ecx, [ebp - 0x44]
call fcn.100168a8
jmp 0x100151f0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x100151f0
push 0
push 0
push 0
push 0
push 0x1e5f
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret

Function at 0x10016730
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b3b7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100167c2
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
push dword [eax]
mov eax, dword [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x40]
push eax
call fcn.100148d2
add esp, 0x10
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
push dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
call fcn.10016cf4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10016d29
jmp 0x100167dc
push 0xee7
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001af79
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001af9a
push 0
push 0xca8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x1001afe2
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001afc8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001afe2
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016adb
and dword [eax], 0
jmp 0x1001afbd
mov esp, ebp
pop ebp
ret

Function at 0x1001cad2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001cafc
push 0xee7
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1001cb41
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, 0x4a49
test eax, eax
je 0x1001cb2e
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
je 0x1001cb2e
mov dword [ebp - 4], 1
jmp 0x1001cb32
and dword [ebp - 4], 0
push 0
mov ecx, dword [ebp - 0x14]
call fcn.10016adb
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1001d054
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001d088
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001d086
push 0xfd2
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x1001d0bd
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0
mov ecx, dword [ebp - 4]
call fcn.10016adb
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx]
add esi, dword [eax]
push 0
mov ecx, dword [ebp - 4]
call fcn.10016adb
mov dword [eax], esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001da72
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001daca
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001daae
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1001dac8
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016adb
or dword [eax], 0xffffffff
jmp 0x1001daa3
jmp 0x1001dae7
push 0
push 0
push 0
push 0
push 0x1e5f
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret
Function at 0x10028086
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x100281eb
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
push 3
mov ecx, dword [ebp - 0x18]
call fcn.10016adb
push 0
mov ecx, dword [ebp - 4]
call fcn.10016adb
mov esi, eax
push 0
mov ecx, dword [ebp - 4]
call fcn.10016adb
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x1002811c
mov dword [ebp - 8], 1
jmp 0x10028120
and dword [ebp - 8], 0
push 0
mov ecx, dword [ebp - 4]
call fcn.10016adb
mov ecx, dword [ebp - 8]
imul ecx, dword [eax]
cmp ecx, 0x25cf
jne 0x10028141
mov dword [ebp - 0xc], 1
jmp 0x10028145
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x44]
mov esi, dword [eax]
push 0
mov ecx, dword [ebp - 0x48]
call fcn.10016adb
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax]
add esi, ecx
cmp esi, 1
je 0x10028169
mov dword [ebp - 0x10], 1
jmp 0x1002816d
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
cmp dword [ebp - 0x10], eax
jg 0x10028180
mov dword [ebp - 0x14], 1
jmp 0x10028184
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
neg eax
jne 0x100281a0
push 3
mov ecx, dword [ebp - 4]
call fcn.10016adb
cmp dword [eax], 0
jne 0x100281a0
and dword [ebp - 0x1c], 0
jmp 0x100281a7
mov dword [ebp - 0x1c], 1
push 3
mov ecx, dword [ebp - 0x18]
call fcn.10016adb
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
jl 0x100281c6
xor eax, eax
inc eax
je 0x100281c6
mov dword [ebp - 0x20], 1
jmp 0x100281ca
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
cmp dword [ebp - 0x20], eax
jl 0x100281dd
mov dword [ebp - 0x24], 1
jmp 0x100281e1
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
jmp 0x10028208
push 0
push 0
push 0
push 0
push 0x1e5f
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10028c04
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10028c5f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10028c40
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10028c5d
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016adb
mov dword [eax], 0x5f36f6dd
jmp 0x10028c35
jmp 0x10028c87
push 0
push 0x25c8
push 0xaf7
push 0x1305
push 0x56c
push 0xff1
push 0x195e
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov esp, ebp
pop ebp
ret
Function at 0x1002ae15
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002ae45
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002ae43
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1002ae8d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002ae73
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1002ae8d
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x18]
call fcn.10016adb
and dword [eax], 0
jmp 0x1002ae68
mov esp, ebp
pop ebp
ret
Function at 0x1002f5d1
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002f617
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x18]
mov dword [eax], ecx
jmp 0x1002f635
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1002f635
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov esp, ebp
pop ebp
ret
Function at 0x1002f843
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push 0x6e7e
push 0x57c8
push 1
push 0x6c7e
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x5666
push 0x7d47
push 0x5b96
push 0x37bf
call fcn.1002f46c
add esp, 0x28
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002f896
xor eax, eax
jmp 0x1002f9dd
push 0x2e31
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push 1
call fcn.1002f5d1
add esp, 0x14
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002f8c3
xor eax, eax
jmp 0x1002f9dd
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 8]
push eax
call fcn.1002f639
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x1002f8e2
xor eax, eax
jmp 0x1002f9dd
lea eax, [ebp - 0xc]
push eax
push 0x64a8
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 8]
push eax
push 0x3c14
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 4]
push eax
call fcn.1002f684
add esp, 0x20
push 0x3641
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp + 8]
push eax
push 0x7459
call fcn.1002f73b
add esp, 0x18
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x1002f957
push dword [ebp - 0x14]
push dword [ebp - 4]
push 1
push 0x789b
push 0x488e
push 0x43bb
call fcn.1002a59d
add esp, 0x18
push dword [ebp - 4]
call fcn.1002e718
pop ecx
test eax, eax
jne 0x1002f968
xor eax, eax
jmp 0x1002f9dd
push 0x7f3b
push dword [ebp - 4]
push 0
call fcn.1002c6cd
add esp, 0xc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002f9c5
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002f999
xor eax, eax
jmp 0x1002f9dd
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002f9b2
xor eax, eax
jmp 0x1002f9dd
push 1
lea eax, [ebp - 4]
push eax
push 0x5cdf
call fcn.1002f7f7
add esp, 0xc
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002f9d6
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002f9da
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10041a39
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10041a70
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10041a6e
push 0
push 0xca8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x10041abb
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10041a9e
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10041abb
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x18]
call fcn.10016adb
mov dword [eax], 0x342eb90d
jmp 0x10041a93
mov esp, ebp
pop ebp
ret

Function at 0x10041b86
Capabilities:
Create process on windows
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10041bc9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10041bc7
push 0
push 0
push 0
push 0
push 0x1e5f
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x10041bdb
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10041bdb
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov esp, ebp
pop ebp
ret
Function at 0x1004499f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100449c9
push 0xee7
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10044a14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100449f7
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x10044a14
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016adb
mov dword [eax], 0x720348f4
jmp 0x100449ec
mov esp, ebp
pop ebp
ret