joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401e00
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408048
call sym._EnterCriticalSection_4
mov ebx, dword [0x408040]
sub esp, 4
test ebx, ebx
je 0x401e4b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401e44
test esi, esi
je 0x401e44
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401e20
mov dword [esp], 0x408048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402030
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402080
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402154
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x4020be
cmp eax, 4
jne 0x4020e0
test esi, esi
je 0x4020d2
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x4020c4
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x40211f
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x402111
cmp ecx, 0x40
je 0x4020d2
cmp ecx, 4
je 0x4020d2
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402030
lea esi, [esi]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000e495
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10071054]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x24], ecx
mov ecx, dword [0x10072c88]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x100734c0
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100734b8]
push edi
cmp eax, dword [ecx + 4]
jle 0x1000e51a
mov edi, 0x100734b8
push edi
call fcn.10018049
cmp dword [0x100734b8], 0xffffffff
pop ecx
jne 0x1000e51a
and dword [0x100734c0], 0
mov ecx, ebx
and dword [0x100734d0], 0
push 0x1006b2d0
mov dword [0x100734d4], 7
call fcn.1000c0c4
push 0x1003c55a
call fcn.1001848a
pop ecx
push edi
call fcn.10017fff
pop ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x1000e524
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000e5b9
cmp dword [0x100734d4], 8
mov ecx, esi
mov edi, dword [esi + 0x14]
cmovae ebx, dword [0x100734c0]
cmp edi, 8
jb 0x1000e54e
mov ecx, dword [esi]
push dword [ebp - 0x24]
mov edx, dword [esi + 0x10]
push dword [0x100734d0]
push ebx
push ecx
call fcn.1000f8c4
add esp, 0x10
cmp eax, 0xffffffff
je 0x1000e5a9
and dword [ebp - 0x20], 0
mov ecx, esi
and dword [ebp - 0x10], 0
cmp dword [esi + 0x10], eax
mov dword [ebp - 0xc], 7
cmovb eax, dword [esi + 0x10]
cmp edi, 8
jb 0x1000e588
mov ecx, dword [esi]
push eax
push ecx
lea ecx, [ebp - 0x20]
call fcn.1000b60b
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
call fcn.1000e495
lea ecx, [ebp - 0x20]
call fcn.1000b597
mov edi, dword [esi + 0x14]
cmp edi, 8
jb 0x1000e5b0
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10017f27
leave
ret 4
Function at 0x1000eb0b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10071054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
mov esi, ecx
cmp bx, di
jne 0x1000eb34
xor eax, eax
jmp 0x1000ec02
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000eb60
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x1000eb60
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x1000ec02
cmp dword [esi + 0x4c], 0
je 0x1000ebff
mov ecx, esi
call fcn.1000f07a
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1000eb8c
push dword [esi + 0x4c]
push edi
call fcn.1000cf5c
pop ecx
pop ecx
test al, al
je 0x1000ebff
movzx ebx, di
jmp 0x1000ebff
movzx eax, di
mov dword [ebp - 0x28], eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x1000ebcd
sub eax, 1
je 0x1000ebcd
dec eax
sub eax, 1
jne 0x1000ebff
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x1000eb7c
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x1000ebf0
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.1002294b
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x1000ebff
lea eax, [ebp - 0x28]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x34], eax
mov ax, di
jne 0x1000ec02
mov ax, bx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10017f27
leave
ret 4

Function at 0x1000f0ca
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10071054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x1000f127
cmp byte [esi + 0x3e], bl
je 0x1000f127
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
cmp di, ax
je 0x1000f160
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, ebx
je 0x1000f138
sub eax, 1
je 0x1000f13b
dec eax
sub eax, 1
jne 0x1000f160
mov byte [esi + 0x3e], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10017f27
leave
ret
mov byte [esi + 0x3e], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000f158
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1002294b
add esp, 0x10
cmp edi, eax
jne 0x1000f160
cmp byte [esi + 0x3e], bl
sete al
jmp 0x1000f129
xor al, al
jmp 0x1000f129
Function at 0x1000fc76
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
sub eax, edi
je 0x1000fcd0
sub eax, 1
jne 0x1000fcf1
mov eax, dword [0x10073470]
mov ecx, eax
inc eax
mov dword [0x10073470], eax
test ecx, ecx
jne 0x1000fcf1
push esi
call fcn.10012173
mov ecx, eax
call fcn.1001649c
call fcn.10015de8
mov esi, eax
lea ecx, [esi + 8]
push ecx
push edi
push esi
push 0x10015ef5
push edi
push edi
call fcn.10025105
add esp, 0x18
mov dword [esi + 4], eax
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
jmp 0x1000fcf1
sub dword [0x10073470], 1
jne 0x1000fcf1
call fcn.10015de8
mov ecx, eax
call fcn.10015e4b
call fcn.10012173
mov ecx, eax
call fcn.1001640a
xor eax, eax
inc eax
pop edi
pop ebp
ret 0xc

Function at 0x1000fef4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1000ff1b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10003955
jmp 0x1000ffd0
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x1000ff3d
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x1000ff3f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x1000ffc4
jg 0x1000ff54
test esi, esi
je 0x1000ffc4
test ecx, ecx
jl 0x1000ffa7
jg 0x1000ff5e
test eax, eax
je 0x1000ffa7
cmp edi, ecx
jg 0x1000ff72
jl 0x1000ff68
cmp esi, eax
jae 0x1000ff72
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.100196d0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [ebx + 0x30]
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
mov eax, dword [ebp + 8]
add eax, ecx
test edi, edi
jl 0x1000ffc4
jg 0x1000ffaa
test esi, esi
je 0x1000ffc4
jmp 0x1000ffaa
mov eax, dword [ebp + 8]
cmp dword [ebx + 0x4c], 0
je 0x1000ffc4
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.1002294b
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000ffd9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
jg 0x1000fffb
jl 0x1000fff2
test edi, edi
jne 0x1000fffb
xor eax, eax
xor edx, edx
jmp 0x100100b4
cmp dword [ecx + 0x38], 0
je 0x10010010
push esi
push edi
push dword [ebp + 8]
call fcn.10003a1e
jmp 0x100100b4
mov eax, dword [ecx + 0x1c]
push ebx
mov ebx, edi
mov edx, dword [eax]
test edx, edx
je 0x1001004f
mov eax, dword [ecx + 0x2c]
cmp dword [eax], 0
jbe 0x1001004f
cmp dword [eax], edi
mov esi, edi
cmovb esi, dword [eax]
push esi
push edx
push dword [ebp + 8]
call fcn.100196d0
mov ecx, dword [ebp - 4]
sub ebx, esi
add dword [ebp + 8], esi
add esp, 0xc
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0x10]
jmp 0x10010055
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
cmp dword [ecx + 0x4c], 0
mov edx, ebx
je 0x100100aa
call fcn.100105f7
mov edx, ebx
jmp 0x10010088
push dword [ecx + 0x4c]
push eax
push 1
push dword [ebp + 8]
call fcn.10023369
add dword [ebp + 8], eax
sub ebx, eax
add esp, 0x10
mov edx, ebx
cmp eax, 0xfff
jne 0x100100ba
mov ecx, dword [ebp - 4]
mov eax, 0xfff
cmp ebx, eax
ja 0x10010066
test edx, edx
je 0x100100aa
push dword [ecx + 0x4c]
push ebx
push 1
push dword [ebp + 8]
call fcn.10023369
mov edx, ebx
add esp, 0x10
sub edx, eax
sub edi, edx
sbb esi, 0
mov eax, edi
mov edx, esi
pop ebx
pop edi
pop esi
leave
ret 0xc
sub edi, ebx
jmp 0x100100ac
Function at 0x10010336
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10071054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x1001035c
xor eax, eax
jmp 0x10010425
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x10010385
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x10010385
dec dword [edx]
mov eax, ebx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x10010425
cmp dword [esi + 0x4c], 0
je 0x10010423
mov ecx, esi
call fcn.100105f7
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100103b2
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.10023079
cmp eax, edi
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x10010423
mov byte [ebp - 0x25], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x100103f2
sub eax, 1
je 0x100103f2
dec eax
sub eax, 1
jne 0x10010423
push dword [esi + 0x4c]
movsx ecx, byte [ebp - 0x25]
push ecx
jmp 0x100103a4
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x10010415
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.1002294b
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x10010423
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x10010425
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10017f27
leave
ret 4

Function at 0x1001061a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10071054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x10010673
cmp byte [esi + 0x3d], bl
je 0x10010673
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100106ac
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, ebx
je 0x10010684
sub eax, 1
je 0x10010687
dec eax
sub eax, 1
jne 0x100106ac
mov byte [esi + 0x3d], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10017f27
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100106a4
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1002294b
add esp, 0x10
cmp edi, eax
jne 0x100106ac
cmp byte [esi + 0x3d], bl
sete al
jmp 0x10010675
xor al, al
jmp 0x10010675
Function at 0x100112cf
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x10071054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
push ebx
push 2
mov dword [ebp - 0x234], edi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x23c], esi
cmp esi, 0xffffffff
jne 0x10011310
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100113d1
push 0x228
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.10019c50
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x100113c0
cmp dword [edi + 4], 0x7432d6
mov eax, dword [edi]
mov dword [ebp - 0x238], eax
je 0x100113e0
push 0x234
mov dword [ebp - 0x244], edi
call fcn.1001811f
mov edx, eax
mov dword [ebp - 0x240], ebx
pop ecx
mov ecx, 0x8b
lea esi, [ebp - 0x230]
lea edi, [edx + 8]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x238]
mov edi, dword [ebp - 0x234]
inc dword [edi + 4]
mov eax, dword [ecx + 4]
mov dword [edx], ecx
mov dword [edx + 4], eax
mov dword [ecx + 4], edx
lea ecx, [ebp - 0x244]
mov dword [eax], edx
call fcn.10011a4d
mov esi, dword [ebp - 0x23c]
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10011341
jmp 0x100113c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10017f27
leave
ret
push str.list_too_long
call fcn.10016aa5
int3
Function at 0x10012ec9
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x34]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
lea ecx, [esi + 0x4c]
call fcn.100138b0
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 0x50]
je 0x1001300a
mov esi, dword [eax + 0xc]
test esi, esi
je 0x1001300a
mov eax, dword [ebp + 0xc]
push 1
pop ebx
sub eax, 0
je 0x10012ffb
dec eax
sub eax, ebx
je 0x10012fd3
sub eax, ebx
je 0x10012fbd
sub eax, ebx
je 0x10012f83
sub eax, ebx
je 0x10012f77
sub eax, 3
je 0x10012f6b
dec eax
sub eax, ebx
jne 0x1001300c
push dword [ebp + 0x14]
lea ecx, [esi + 0x134]
call fcn.1000c0c4
call fcn.10013f16
push dword [ebp + 0x14]
push 0xa
push dword [ebp + 8]
mov ecx, eax
call fcn.1000cf05
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1001300c
call fcn.10013f16
push dword [ebp + 0x14]
push 8
jmp 0x10012f53
call fcn.10013f16
push dword [ebp + 0x14]
push 5
jmp 0x10012f53
cmp byte [esi], 0
je 0x1001300c
mov eax, dword [ebp + 0x10]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1006c1c0]
movsd qword [ebp - 8], xmm0
movsd xmm0, qword [esi + 0x170]
call fcn.1000ce62
movsd xmm3, qword [ebp - 8]
push ebx
jmp 0x10012fef
cmp byte [esi], 0
je 0x1001300c
movsd xmm0, qword [esi + 0x170]
call fcn.1000ce62
push 5
jmp 0x10012fe7
cmp byte [esi], 0
je 0x1001300c
movsd xmm0, qword [esi + 0x170]
call fcn.1000ce62
push 4
movsd xmm3, qword [0x1006c0e0]
movaps xmm2, xmm0
mov ecx, esi
call fcn.1000dc93
jmp 0x1001300c
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
call fcn.1000d111
jmp 0x1001300c
xor bl, bl
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 0x10
Function at 0x10013e75
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x14
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
push esi
lea esi, [eax*2 + 2]
jb 0x10013e91
mov edx, dword [edx]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x10013e9c
mov eax, dword [eax]
push esi
push edx
push 1
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10013eb4
pop esi
leave
ret 8
push str.Cannot_write_string_value:_RegSetValueExW_failed.
push eax
lea ecx, [ebp - 0x14]
call fcn.10013ed1
push 0x1006f254
lea eax, [ebp - 0x14]
push eax
call fcn.1001929d
int3
Function at 0x10015f0a
Capabilities:
Connect pipe
Create pipe
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5030
call fcn.10019120
mov eax, dword [0x10071054]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x5024], 0
xor eax, eax
push ebx
push esi
xor esi, esi
mov ebx, 0x10073634
push edi
inc eax
xchg dword [ebx], eax
mov eax, dword [0x10073634]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 3
pop ebx
jmp 0x10016004
push 0
lea eax, [ebp - 0x5020]
push eax
push 1
push str.S:_ML__NW___LW_D:_A__0x12019f___WD_
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorA]
mov eax, dword [ebp - 0x5020]
mov dword [ebp - 0x502c], eax
lea eax, [ebp - 0x5030]
push eax
push 0
push 0x200c
push 0x200c
push 0xff
push 6
push ebx
push str..pipeAppMonD_DataWindow
mov dword [ebp - 0x5030], 0xc
mov dword [ebp - 0x5028], 1
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001608b
push 0
push esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x10015fd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x10015fd2
push esi
call edi
xor esi, esi
jmp 0x10015fff
mov eax, dword [0x10073634]
cmp eax, 1
jne 0x10016080
lea eax, [ebp - 0x5024]
push eax
xor eax, eax
push eax
push esi
push 0x100160e4
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10016031
push eax
call edi
mov eax, dword [0x10073634]
cmp eax, 1
je 0x10015f4a
mov eax, 0x10073634
xchg dword [eax], ebx
test esi, esi
je 0x10016020
cmp esi, 0xffffffff
je 0x10016020
push esi
call edi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10017f27
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x501c]
call fcn.10016286
cmp dword [eax + 0x14], 8
jb 0x1001604c
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x5004]
push str.CreateThread_failed:__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x501c]
call fcn.1000b597
push esi
call edi
call fcn.10013f16
lea ecx, [ebp - 0x5004]
push ecx
push 0xfffffffffffffff4
jmp 0x100160d5
test esi, esi
je 0x10016087
push esi
call edi
xor esi, esi
jmp 0x1001600d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x501c]
call fcn.10016286
cmp dword [eax + 0x14], 8
jb 0x100160a6
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x5004]
push str.CreateNamedPipe_failed:__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x501c]
call fcn.1000b597
call fcn.10013f16
lea ecx, [ebp - 0x5004]
push ecx
push 0xfffffffffffffff5
mov ecx, eax
call fcn.10011fea
or eax, 0xffffffff
jmp 0x10016022
Function at 0x1001649c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
lea esi, [edi + 0x28]
mov dword [edi + 0x24], ebx
push esi
push ebx
push edi
push 0x10016506
push ebx
push ebx
mov dword [esi], ebx
call fcn.10025105
add esp, 0x18
mov dword [edi + 0x24], eax
test eax, eax
je 0x100164ff
cmp dword [esi], ebx
je 0x100164ff
mov dword [ebp - 4], ebx
push 0xa
lea ebx, [edi + 8]
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [edi + 0x20]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, 1
sete bl
je 0x100164ff
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, 0xa
jb 0x100164cf
pop edi
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x1002d4dc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002d18d

Function at 0x1002d4e7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002d317

Function at 0x100339b3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10033630

Function at 0x1003f2ba
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x1007603c], 0
je 0x1003f31b
cmp word [0x10076210], 0xd7b2
jne 0x1003f2e3
cmp dword [0x10076218], 0
jbe 0x1003f2e3
mov eax, 0x1007620c
call dword [0x10076228]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x1007405c
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
push eax
call sub.KERNEL32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x1003f342
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
push eax
call sub.KERNEL32.dll_WriteFile
pop edx
ret
cmp byte [0x10074020], 0
jne 0x1003f337
push 0
push 0x10074054
push 0x1007405c
push 0
call sub.USER32.dll_MessageBoxA
pop edx
ret

Function at 0x1004071a
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x10040780
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.1003f65e
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.1003e71e
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x1004076a
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10040787
lea eax, [ebp - 0x10]
call fcn.1003f436
ret

Function at 0x10042b16
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
mov edx, esi
call fcn.1003f48a
mov eax, ebx
call fcn.1003f8da
mov eax, dword [ebx]
call fcn.1003f68a
test eax, eax
jle 0x10042b47
mov edx, 1
mov ecx, dword [ebx]
xor byte [ecx + edx - 1], 0x55
inc edx
dec eax
jne 0x10042b3c
pop esi
pop ebx
ret