joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4021f0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
sub esp, 0x148
mov eax, dword [0x40e3e0]
xor eax, esp
mov dword [esp + 0x144], eax
push ebp
mov ebp, dword [esp + 0x154]
push esi
push edi
push 0x104
lea eax, [esp + 0x50]
push 0
push eax
call fcn.00404c50
mov eax, dword [esp + 0x164]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0xc
sub eax, 1
je 0x4022b0
sub eax, 1
je 0x40229e
sub eax, 1
jne 0x402300
lea ecx, [esp + 0x4c]
push ecx
push eax
push eax
push 0x23
push eax
call fcn.00403140
add esp, 0x14
lea edx, [esp + 0x4c]
push edx
call edi
cmp byte [esp + eax + 0x4b], 0x5c
je 0x40226c
mov byte [esp + eax + 0x4c], 0x5c
mov byte [esp + eax + 0x4d], 0
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x402300
mov byte [ebp], 0
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.00404c23
add esp, 0x148
ret
lea ecx, [esp + 0x4c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x402254
push 0x104
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x4c]
push edx
call edi
cmp byte [esp + eax + 0x4b], 0x5c
je 0x4022d4
mov byte [esp + eax + 0x4c], 0x5c
inc eax
lea esi, [esp + eax + 0x4c]
push str.Temp
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x402280
push 0x40b28c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.2404242156528592387631800
call edi
dec eax
cmp eax, 8
jl 0x402284
mov al, byte [eax + str.2404242156528592387631800]
cmp al, 0x30
jl 0x402284
cmp al, 0x39
jg 0x402284
movsx esi, al
sub esi, 0x30
and esi, reloc.WS2_32.dll_closesocket
jns 0x40233a
dec esi
or esi, 0xfffffffc
inc esi
push str.2404242156528592387631800
add esi, 4
call edi
sub eax, esi
dec eax
xor ecx, ecx
lea eax, [eax + str.2404242156528592387631800]
nop
mov dl, byte [eax]
test dl, dl
je 0x4023b5
test esi, esi
jle 0x4023b5
add dl, dl
inc dl
inc eax
mov byte [esp + ecx + 0xc], dl
mov dl, byte [eax]
dec esi
test dl, dl
je 0x4023aa
test esi, esi
jle 0x4023aa
add dl, dl
inc dl
inc eax
mov byte [esp + ecx + 0xd], dl
mov dl, byte [eax]
dec esi
test dl, dl
je 0x4023ad
test esi, esi
jle 0x4023ad
add dl, dl
inc dl
inc eax
mov byte [esp + ecx + 0xe], dl
mov dl, byte [eax]
dec esi
test dl, dl
je 0x4023b2
test esi, esi
jle 0x4023b2
add dl, dl
inc dl
mov byte [esp + ecx + 0xf], dl
add ecx, 4
dec esi
inc eax
cmp ecx, 0x40
jb 0x402350
jmp 0x4023b5
inc ecx
jmp 0x4023b5
add ecx, 2
jmp 0x4023b5
add ecx, 3
mov byte [esp + ecx + 0xc], 0x2e
push 0x40b288
lea ecx, [esp + ecx + 0x11]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x4c]
push edx
call edi
mov ecx, 0x104
sub ecx, eax
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x54]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea ecx, [esp + eax + 0x54]
push ecx
call esi
push 0x103
lea edx, [esp + 0x50]
push edx
push ebp
call esi
mov ecx, dword [esp + 0x150]
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.00404c23
add esp, 0x148
ret
Function at 0x10001731
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10001740
pop dword [ebp - 0x40]
mov eax, 0xb82bf8e1
sub eax, 0xa82be1a1
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x437a1186
add dword [ebp - 0x50], 0xad833c5
mov dword [ebp - 0x4c], 0xdd2f246a
sub dword [ebp - 0x4c], 0xaafbd825
mov dword [ebp - 0x48], 0x66a504e8
add dword [ebp - 0x48], 0xe5a73f46
mov dword [ebp - 0x44], 0x361735dd
sub dword [ebp - 0x44], 0x361735dd
lea eax, [ebp - 0x50]
push eax
mov eax, 0x321a33b3
add eax, 0xdde79c55
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x613dcccc
add dword [ebp - 0x50], 0x13349c8a
mov dword [ebp - 0x4c], 0x54a29ff4
add dword [ebp - 0x4c], 0xecc9c181
mov dword [ebp - 0x48], 0x721d9624
sub dword [ebp - 0x48], 0xeae29b8
mov dword [ebp - 0x44], 0xbb962d22
add dword [ebp - 0x44], 0x4469d2de
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3d26f
push 0
call eax
mov ecx, 0x1e0f62eb
sub ecx, 0x1e0f0f63
xor ebx, ebx
add ebx, eax
mov esi, 0x1002e000
add esi, dword [ebp - 0x40]
mov edi, 0xb6219fe2
xor dword [ebp - 0x1c], ecx
mov edx, dword [esi]
add dword [ebp - 0x34], 0xa2717c1a
sub edx, edi
mov dword [ebx], edx
sub dword [ebp - 0x18], ebx
add ebx, 4
add esi, 0x95284f2f
sub esi, 0x95284f2b
loop 0x10001853
add eax, 0xbb6f58e8
sub eax, 0xbb6e17f5
mov ebx, eax
add eax, 0xaa4e28b0
sub eax, 0xaa4e28ab
mov ecx, 0x129b1b5
sub ecx, 0xf129b1b5
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x10001299
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x10006a60
test bh, al
clc
add byte [eax], al
add byte [ebx + 0x448d2478], cl
or bh, bh
Function at 0x10001609
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x10006790
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10006384
push eax
push esi
push dword [ebp + 8]
call fcn.10006339
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10006374
ret 0xae5

Function at 0x100025c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push ebx
push esi
push edi
mov dword [ebp - 4], 7
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100026ad
cmp dword [ebp - 0x108], 2
jne 0x100026ad
cmp dword [ebp - 0x114], 6
jne 0x10002618
cmp dword [ebp - 0x110], 2
jne 0x10002618
mov dword [ebp - 4], 6
cmp dword [ebp - 0x114], 6
jne 0x10002631
cmp dword [ebp - 0x110], 1
jne 0x10002631
mov dword [ebp - 4], 5
cmp dword [ebp - 0x114], 6
jne 0x1000264c
cmp dword [ebp - 0x110], 0
jne 0x1000264c
mov dword [ebp - 4], 4
jmp 0x100026ad
cmp dword [ebp - 0x114], 5
jne 0x10002667
cmp dword [ebp - 0x110], 2
jne 0x10002667
mov dword [ebp - 4], 3
jmp 0x100026ad
cmp dword [ebp - 0x114], 5
jne 0x10002682
cmp dword [ebp - 0x110], 1
jne 0x10002682
mov dword [ebp - 4], 2
jmp 0x100026ad
cmp dword [ebp - 0x114], 5
jne 0x1000269d
cmp dword [ebp - 0x110], 0
jne 0x1000269d
mov dword [ebp - 4], 1
jmp 0x100026ad
cmp dword [ebp - 0x114], 4
jne 0x100026ad
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b340
Capabilities:
Create process memory minidump

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x10013818
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000b3d7
cmp dword [ebp - 4], 0xffffffff
je 0x1000b3d7
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
je 0x1000b3a0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x5c], eax
jmp 0x1000b3a7
mov dword [ebp - 0x5c], 0
push 0
push 0
mov ecx, dword [ebp - 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.dbghelp.dll_MiniDumpWriteDump
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a54f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1001a55e
pop dword [ebp - 0xc]
mov eax, 0x7230fbe0
add eax, 0x9dd0a97e
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x597cdc10
sub dword [ebp - 0x1c], 0xb2a96c5
mov dword [ebp - 0x18], 0x8778a882
add dword [ebp - 0x18], 0xaabaa3c3
mov dword [ebp - 0x14], 0x22062735
sub dword [ebp - 0x14], 0xd5b9e307
mov dword [ebp - 0x10], 0x7e3ab730
sub dword [ebp - 0x10], 0x7e3ab730
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x2c343bbe
sub eax, 0x1c325b3e
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xee76a7b5
sub dword [ebp - 0x1c], 0x7a043e5f
mov dword [ebp - 0x18], 0xbb13c0d2
add dword [ebp - 0x18], 0x8658a0a3
mov dword [ebp - 0x14], 0x5bf75f30
sub dword [ebp - 0x14], 0xf887f2c4
mov dword [ebp - 0x10], 0x7dc79fdb
add dword [ebp - 0x10], 0x82386025
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3ce0e
push 0
call eax
mov ecx, 0x737e7d98
sub ecx, 0x737e3734
xor edx, edx
add edx, eax
mov esi, 0x29381b9b
sub esi, 0x1934c39b
add esi, dword [ebp - 0xc]
mov ebx, 0x4b4631bc
add ebx, 0xa86be2ec
add dword [ebp - 4], 0x4cb3cf9d
mov edi, dword [esi]
sub dword [ebp - 8], 0x7d5828f9
xor edi, ebx
add dword [ebp - 4], 0xfd61a2d1
mov dword [edx], edi
sub dword [ebp - 4], edx
add edx, 0x28fbcd8d
sub edx, 0x28fbcd89
add esi, 4
loop 0x1001a67d
add eax, 0x10c63
xor ebx, ebx
add ebx, eax
add eax, 0xd7f2ca0c
sub eax, 0xd7f2ca07
mov ecx, 0x4bacacbb
sub ecx, 0x3bacacbb
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x401c66
pop dword [ebp - 0x44]
mov eax, 0x401c66
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x769defd2
sub dword [ebp - 0x54], 0x284baa87
mov dword [ebp - 0x50], 0x6f9cd44c
sub dword [ebp - 0x50], 0x3d698807
mov dword [ebp - 0x4c], 0x800efbbe
add dword [ebp - 0x4c], 0xcc3d4870
mov dword [ebp - 0x48], 0x653d970e
add dword [ebp - 0x48], 0x9ac268f2
lea eax, [ebp - 0x54]
push eax
mov eax, 0x4bdc1dad
sub eax, 0x4b9bed59
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x2c74997c
add dword [ebp - 0x54], 0x47fdcfda
mov dword [ebp - 0x50], 0x543ece05
sub dword [ebp - 0x50], 0x12d26c90
mov dword [ebp - 0x4c], 0x69265cb5
sub dword [ebp - 0x4c], 0x5b6f049
mov dword [ebp - 0x48], 0xeb75ea88
sub dword [ebp - 0x48], 0xeb75ea88
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x8c13e7c5
sub eax, 0x8bd3b799
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x36e6e
push 0
call eax
mov ecx, 0x49af
mov ebx, eax
mov edi, 0x407000
add edi, dword [ebp - 0x44]
mov edx, 0xce2326cf
mov dword [ebp - 0x3c], 0x54a592a2
mov esi, dword [edi]
add dword [ebp - 0x30], 0x92e3b039
add esi, edx
xor dword [ebp - 0x14], 0x18df7535
mov dword [ebx], esi
xor dword [ebp - 0x20], edx
add ebx, 0x46e58e19
sub ebx, 0x46e58e15
add edi, 0x3d2b9dcf
add edi, 0xc2d46235
loop 0x401d71
add eax, 0x1198f
mov ebx, eax
add eax, 0xbab910ee
sub eax, 0xbab910e9
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430a67ba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430aa9f0]
jne 0x430a67c4
repz ret
jmp fcn.430a7df9

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x2d85513a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x2d855149
pop dword [ebp - 8]
mov eax, 0x27d2b55d
add eax, 0x5b29bec
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xbfcf43ec
add dword [ebp - 0x18], 0x8e83015f
mov dword [ebp - 0x14], 0xe29a6f87
add dword [ebp - 0x14], 0x4f98dcbe
mov dword [ebp - 0x10], 0xbdd42750
sub dword [ebp - 0x10], 0x7187e322
mov dword [ebp - 0xc], 0x3aaafb55
add dword [ebp - 0xc], 0xc55504ab
lea eax, [ebp - 0x18]
push eax
mov eax, 0xe3d3ff95
add eax, 0x49bb1113
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x537d6af0
sub dword [ebp - 0x18], 0xdf0b019a
mov dword [ebp - 0x14], 0xa80f9da1
sub dword [ebp - 0x14], 0x66a33c2c
mov dword [ebp - 0x10], 0xf0058768
add dword [ebp - 0x10], 0x7369e504
mov dword [ebp - 0xc], 0xf107eee7
add dword [ebp - 0xc], 0xef81119
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xe2aa70d6
sub eax, 0xb51b6036
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x69e11
push 0
call eax
mov ecx, 0x2876c5b
sub ecx, 0x28721c5
xor ebx, ebx
add ebx, eax
mov esi, 0xe7609bd
add esi, 0x1f242243
add esi, dword [ebp - 8]
mov edi, 0x7e7a5af
add edi, 0x33cba149
mov edx, dword [esi]
xor dword [ebp - 4], edi
xor edx, edi
add dword [ebp - 4], 0xe6ec9cf0
mov dword [ebx], edx
mov dword [ebp - 4], 0x7c24c96
add ebx, 4
add esi, 4
loop 0x2d85526d
add eax, 0xcdd7977b
sub eax, 0xcdd67a50
mov ebx, eax
add eax, 0xf6c34036
sub eax, 0xf6c34031
mov ecx, 0x41eeb38
sub ecx, 0xd69eeb38
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x1001139d
Capabilities:
Accept command line arguments

Disassembly:
push 8
push 0x10011430
call fcn.1000ed82
xor edi, edi
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x100265f7
test eax, eax
je 0x10031507
cmp eax, 2
jne 0x100116c7
push dword [0x100de7cc]
call sym.MSVCR120.dll_clogf
pop ecx
test eax, eax
jne 0x1001141b
push 0x3bc
push 1
call sym.MSVCR120.dll_clogf
pop ecx
pop ecx
mov esi, eax
test esi, esi
je 0x10031555
push esi
push dword [0x100de7cc]
call sym.MSVCR120.dll_clogf
pop ecx
pop ecx
test eax, eax
je 0x10050453
push edi
push esi
call sym.MSVCR120.dll__initptd
pop ecx
pop ecx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [esi], eax
or dword [esi + 4], 0xffffffff
call fcn.10011398
xor eax, eax
inc eax
call fcn.1000edc7
ret
cmp eax, 3
jne 0x1001141b
push edi
call sym.MSVCR120.dll_clogf
pop ecx
jmp 0x1001141b
call fcn.100261c8
test eax, eax
je 0x10031555
call fcn.10026580
test eax, eax
je 0x100503fe
call fcn.10026f4d
test eax, eax
js 0x10050408
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov dword [sym.MSVCR120.dll__wcmdln], eax
call sym.MSVCR120.dll_clogf
jmp 0x100268e4
mov dword [0x100dfbbc], eax
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [sym.MSVCR120.dll__acmdln], eax
call fcn.10026c85
call fcn.10026928
test eax, eax
js 0x1003155c
push edi
call sym.MSVCR120.dll_clogf
pop ecx
test eax, eax
jne 0x1003155c
test edi, edi
jne 0x1005040f
inc dword [0x100dfbb8]
jmp 0x1001141b
mov eax, dword [0x100dfbb8]
test eax, eax
jle 0x10031555
dec eax
mov dword [0x100dfbb8], eax
mov dword [ebp - 4], edi
cmp dword [0x100e0418], 0
je 0x10050416
call fcn.10031219
call fcn.10031260
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x10050420
mov dword [ebp - 4], 0xfffffffe
call fcn.1003154c
jmp 0x1001141b
xor eax, eax
jmp 0x10011423
xor edi, edi
inc edi
jmp 0x10026915
call fcn.1009f373
jmp 0x10031555
call fcn.100775db
jmp 0x100503fe
call fcn.1009f9c4
jmp 0x10050408
call sym.MSVCR120.dll__cexit
jmp 0x10031526
call fcn.1009f9c4
call fcn.100775db
call fcn.1009f373
jmp 0x1003153b
push esi
call sym.MSVCR120.dll_clogf
pop ecx
jmp 0x10031555
Function at 0x1001f855
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100de7b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x21c], 0
push ebx
or ebx, 0xffffffff
push esi
lea esi, [ebp - 0x218]
test eax, eax
je 0x10051169
push edi
push eax
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x1001f921
lea eax, [ebp - 0x218]
push eax
push 0x105
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov edi, eax
cmp edi, 0x104
jg 0x10051186
test edi, edi
je 0x1001f921
movzx eax, word [esi]
cmp eax, 0x5c
je 0x1001f919
cmp eax, 0x2f
je 0x1001f919
push 0x3d
pop eax
mov word [ebp - 0xc], ax
movzx eax, word [esi]
push eax
call sym.MSVCR120.dll_clogf
pop ecx
push 0x3a
mov word [ebp - 0xa], ax
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push esi
push eax
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x1001f921
xor ebx, ebx
cmp dword [ebp - 0x21c], 0
pop edi
jne 0x100511cd
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.10010cbc
mov esp, ebp
pop ebp
ret
cmp ax, word [esi + 2]
je 0x1001f8f7
jmp 0x1001f8c6
call dword [sym.imp.kernel32.dll_GetLastError]
jmp 0x100511c1
call sym.MSVCR120.dll___doserrno
and dword [eax], 0
call sym.MSVCR120.dll__errno
mov dword [eax], 0x16
call sym.MSVCR120.dll__invalid_parameter_noinfo
jmp 0x1001f907
lea eax, [edi + 1]
push 2
push eax
call sym.MSVCR120.dll_clogf
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1001f921
mov dword [ebp - 0x21c], 1
test edi, edi
je 0x1001f921
push esi
lea eax, [edi + 1]
push eax
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov edi, eax
jmp 0x1001f8b5
push eax
call sym.MSVCR120.dll_clogf
pop ecx
jmp 0x1001f8f9
push esi
call sym.MSVCR120.dll_clogf
pop ecx
jmp 0x1001f907

Function at 0x1001f985
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100de7b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 1
jl 0x1001f9d8
cmp eax, 0x1a
jg 0x1001f9d8
add eax, 0x40
mov word [ebp - 0xc], ax
push 0x3a
pop eax
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x100510c2
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010cbc
mov esp, ebp
pop ebp
ret
call sym.MSVCR120.dll___doserrno
jmp 0x100510d1
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR120.dll_clogf
pop ecx
jmp 0x100510e7
mov dword [eax], 0xf
call sym.MSVCR120.dll__errno
mov dword [eax], 0xd
call sym.MSVCR120.dll__invalid_parameter_noinfo
or eax, 0xffffffff
jmp 0x1001f9ca

Function at 0x1002241a
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, 0x811c9dc5
xor esi, esi
movzx eax, byte [esi + ecx]
xor eax, edi
imul edi, eax, 0x1000193
inc esi
cmp esi, 4
jb 0x10022426
mov eax, edi
xor edx, edx
div ebx
pop edi
pop esi
mov eax, edx
pop ebx
ret
Function at 0x10022fe7
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
push 0x800
push 0
mov esi, 0x10023094
mov ebx, ecx
push esi
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10050052
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x100230b0
push edi
call esi
mov ecx, dword [0x100def00]
push 0x100230c4
xor ecx, eax
push edi
mov dword [ebx], ecx
call esi
mov ecx, dword [0x100def00]
push 0x100230dc
xor ecx, eax
push edi
mov dword [ebx + 4], ecx
call esi
mov ecx, dword [0x100def00]
push 0x100230e8
xor ecx, eax
push edi
mov dword [ebx + 8], ecx
call esi
mov ecx, dword [0x100def00]
push 0x10023100
xor ecx, eax
push edi
mov dword [ebx + 0xc], ecx
call esi
mov ecx, dword [0x100def00]
push 0x10023114
xor ecx, eax
push edi
mov dword [ebx + 0x10], ecx
call esi
mov ecx, dword [0x100def00]
xor ecx, eax
mov dword [ebx + 0x14], ecx
pop edi
pop esi
mov eax, ebx
pop ebx
ret
mov edi, eax
test edi, edi
je 0x10023080
jmp 0x10023009
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x57
jne 0x10023080
push esi
call dword [sym.imp.kernel32.dll_LoadLibraryW]
jmp 0x10023086

Function at 0x1002541d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push edi
xor edi, edi
test ebx, ebx
je 0x10050778
push esi
push 0x3bc
push 1
call sym.MSVCR120.dll_clogf
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10050797
call sym.MSVCR120.dll__getptd
push dword [eax + 0x6c]
push esi
call sym.MSVCR120.dll__initptd
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x58], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x54], ebx
pop ecx
pop ecx
test eax, eax
jne 0x1002546f
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x10025498
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0x1005078f
pop esi
pop edi
pop ebx
pop ebp
ret
call sym.MSVCR120.dll__errno
mov dword [eax], 0x16
call sym.MSVCR120.dll__invalid_parameter_noinfo
xor eax, eax
jmp 0x1002548e
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
push esi
call sym.MSVCR120.dll_clogf
pop ecx
test edi, edi
je 0x100507a9
push edi
call sym.MSVCR120.dll_clogf
pop ecx
xor eax, eax
jmp 0x1002548d