joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a1920
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x63d360]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a1b0a
sub esp, 0x48
mov eax, dword [0x5f8f8c]
mov ecx, dword [esp + 0x50]
movzx edx, word [ecx + 2]
movzx ebx, word [ecx + 8]
movzx ebp, word [ecx + 0xa]
movzx esi, word [ecx + 0xc]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
call sym.time.Date
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.0046462e
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.0046462e
call sym.time.Time.abs
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 0x15180
mov dword [esp], eax
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x93a80
mov dword [esp + 0xc], 0
call sym.runtime.uint64mod
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
mov eax, ebp
sar ebp, 0x1f
add eax, edx
sar eax, 0x10
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x4a19f7
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x4a1a11
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x4a1a88
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x4a1a5e
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x4a1a5a
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x4a1a53
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x4a1a60
mov ebx, 0x1d
jmp 0x4a1a7e
mov ebp, eax
jmp 0x4a1a60
mov ebp, eax
cmp ebp, 0xd
jae 0x4a1afd
lea eax, [ebp - 1]
lea edx, [0x5e9d00]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x4a1af3
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x4a1a88
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x4a1aba
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ecx, 0x1f
shr ebx, 0x1f
or ebp, ebx
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x4a1ac2
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
mov dword [esp + 0x54], eax
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
add esp, 0x48
ret
mov ecx, 0xd
call sym.runtime.panicIndex
mov eax, ebp
mov ecx, 0xd
call sym.runtime.panicIndex
nop
call sym.runtime.morestack_noctxt
jmp sym.time.pseudoUnix
Function at 0x4b3a10
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x63d360]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b3ab1
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [esp + 0x18]
cmp dword [edx], ecx
jne 0x4b3aa7
movzx ecx, byte [eax + 4]
cmp byte [edx + 4], cl
jne 0x4b3aa7
movzx ecx, byte [eax + 5]
cmp byte [edx + 5], cl
jne 0x4b3aa7
movzx ecx, byte [eax + 6]
cmp byte [edx + 6], cl
jne 0x4b3aa7
movzx ecx, byte [eax + 7]
cmp byte [edx + 7], cl
jne 0x4b3aa7
movzx ecx, byte [eax + 8]
cmp byte [edx + 8], cl
jne 0x4b3aa7
movzx ecx, byte [eax + 9]
cmp byte [edx + 9], cl
jne 0x4b3aa7
movzx ecx, byte [eax + 0xa]
cmp byte [edx + 0xa], cl
jne 0x4b3aa7
movzx ecx, byte [eax + 0xb]
cmp byte [edx + 0xb], cl
jne 0x4b3aa7
movzx ecx, byte [eax + 0xc]
cmp byte [edx + 0xc], cl
jne 0x4b3aa7
add eax, 0x10
mov dword [esp], eax
lea eax, [edx + 0x10]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x4c
call sym.runtime.memequal
movzx eax, byte [esp + 0xc]
jmp 0x4b3aa9
xor eax, eax
mov byte [esp + 0x1c], al
add esp, 0x10
ret
call sym.runtime.morestack_noctxt
jmp sym.type:.eq.fmt.fmt
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x10201bb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102672e8
push sym.MSVCR71D.dll__except_handler3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
call fcn.10201d10
mov dword [ebp - 4], 0
cmp dword [0x1027eb40], 1
jne 0x10201bf9
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x1027eb3c], 1
mov cl, byte [ebp + 0x10]
mov byte [0x1027eb38], cl
cmp dword [ebp + 0xc], 0
jne 0x10201c5e
cmp dword [0x1027f58c], 0
je 0x10201c4c
mov edx, dword [0x1027f588]
sub edx, 4
mov dword [0x1027f588], edx
mov eax, dword [0x1027f588]
cmp eax, dword [0x1027f58c]
jb 0x10201c4c
mov ecx, dword [0x1027f588]
cmp dword [ecx], 0
je 0x10201c4a
mov edx, dword [0x1027f588]
call dword [edx]
jmp 0x10201c1b
push 0x1027a038
push 0x1027a028
call sym.MSVCR71D.dll__initterm
add esp, 8
push 0x1027a044
push 0x1027a03c
call sym.MSVCR71D.dll__initterm
add esp, 8
mov dword [ebp - 4], 0xffffffff
call fcn.10201c7e
jmp 0x10201c8a
cmp dword [ebp + 0x10], 0
je 0x10201c92
jmp 0x10201ca8
mov dword [0x1027eb40], 1
mov eax, dword [ebp + 8]
push eax
call fcn.10201cc0
add esp, 4
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10201e00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x1027c570]
mov dword [ebp - 0x14], eax
push esi
mov dword [ebp - 4], 0
jmp 0x10201e24
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x13
jae 0x10201e3d
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx*8 + 0x1027a060]
jne 0x10201e3b
jmp 0x10201e3d
jmp 0x10201e1b
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax*8 + 0x1027a060]
jne 0x10201ffb
cmp dword [ebp + 8], 0xfc
je 0x10201e83
cmp dword [ebp + 8], 0xff
je 0x10201e83
mov edx, dword [ebp - 4]
mov eax, dword [edx*8 + 0x1027a064]
push eax
push 0
push 0
push 0
push 1
call sym.MSVCR71D.dll__CrtDbgReport
add esp, 0x14
cmp eax, 1
jne 0x10201e83
int3
cmp dword [0x1027eb60], 1
je 0x10201e9e
cmp dword [0x1027eb60], 0
jne 0x10201ed7
cmp dword [0x1027eb64], 1
jne 0x10201ed7
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx*8 + 0x1027a064]
push eax
call sym.MSVCR71D.dll_strlen
add esp, 4
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*8 + 0x1027a064]
push edx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x10201ffb
cmp dword [ebp + 8], 0xfc
je 0x10201ffb
mov byte [ebp - 0x1c], 0
push 0x104
lea eax, [ebp - 0x120]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10201f14
push str._program_name_unknown_
lea ecx, [ebp - 0x120]
push ecx
call sym.MSVCR71D.dll__mbscpy
add esp, 8
lea edx, [ebp - 0x120]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
call sym.MSVCR71D.dll_strlen
add esp, 4
add eax, 1
cmp eax, 0x3c
jbe 0x10201f5d
lea ecx, [ebp - 0x120]
push ecx
call sym.MSVCR71D.dll_strlen
add esp, 4
mov edx, dword [ebp - 0x10]
lea eax, [edx + eax - 0x3b]
mov dword [ebp - 0x10], eax
push 3
push 0x10267700
mov ecx, dword [ebp - 0x10]
push ecx
call sym.MSVCR71D.dll_strncpy
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
call sym.MSVCR71D.dll_strlen
add esp, 4
mov esi, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x1027a064]
push ecx
call sym.MSVCR71D.dll_strlen
add esp, 4
lea eax, [esi + eax + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.10201a90
mov dword [ebp - 0x124], esp
mov edx, dword [ebp - 0x124]
mov dword [ebp - 0xc], edx
push str.Runtime_Error__n_nProgram:
mov eax, dword [ebp - 0xc]
push eax
call sym.MSVCR71D.dll__mbscpy
add esp, 8
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call sym.MSVCR71D.dll__mbscat
add esp, 8
push 0x102676e0
mov eax, dword [ebp - 0xc]
push eax
call sym.MSVCR71D.dll__mbscat
add esp, 8
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*8 + 0x1027a064]
push edx
mov eax, dword [ebp - 0xc]
push eax
call sym.MSVCR71D.dll__mbscat
add esp, 8
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1020c140
add esp, 0xc
lea esp, [ebp - 0x128]
mov ecx, dword [ebp - 0x14]
call fcn.1020cd80
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10202e70
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
jne 0x10202e96
call sym.MSVCR71D.dll__errno
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x10202f51
push 0x4e
push str.thread.c
push 2
push 0x8c
push 1
call sym.MSVCR71D.dll__calloc_dbg
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10202eb9
jmp 0x10202f2e
mov eax, dword [ebp - 8]
push eax
call fcn.102034a0
add esp, 4
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x4c], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x50], ecx
mov edx, dword [ebp - 8]
push edx
push 4
mov eax, dword [ebp - 8]
push eax
push 0x10202f60
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
cmp dword [ebp - 4], 0
jne 0x10202f0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
jmp 0x10202f2e
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x10202f29
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
jmp 0x10202f2e
mov eax, dword [ebp - 4]
jmp 0x10202f51
push 2
mov edx, dword [ebp - 8]
push edx
call sym.MSVCR71D.dll__free_dbg
add esp, 8
cmp dword [ebp - 0xc], 0
je 0x10202f4e
mov eax, dword [ebp - 0xc]
push eax
call fcn.102048f0
add esp, 4
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x102030d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0x10], 0
jne 0x102030f5
call sym.MSVCR71D.dll__errno
mov dword [eax], 0x16
xor eax, eax
jmp 0x102031a6
push 0x74
push str.threadex.c
push 2
push 0x8c
push 1
call sym.MSVCR71D.dll__calloc_dbg
add esp, 0x14
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10203118
jmp 0x10203184
mov eax, dword [ebp - 0xc]
push eax
call fcn.102034a0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 0x4c], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0x50], ecx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], 0xffffffff
cmp dword [ebp + 0x1c], 0
jne 0x1020314c
lea eax, [ebp - 4]
mov dword [ebp + 0x1c], eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 0x102031b0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1020317f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x10203184
mov eax, dword [ebp - 8]
jmp 0x102031a6
push 2
mov eax, dword [ebp - 0xc]
push eax
call sym.MSVCR71D.dll__free_dbg
add esp, 8
cmp dword [ebp - 0x10], 0
je 0x102031a4
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.102048f0
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10203d30
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x10203db5
cmp dword [0x1027edd4], 0
jne 0x10203d71
push 0x190
push str.wild.c
push 2
push 0x244
call sym.MSVCR71D.dll__malloc_dbg
add esp, 0x10
mov dword [0x1027edd4], eax
cmp dword [0x1027edd4], 0
jne 0x10203d71
xor eax, eax
jmp 0x10203df5
cmp dword [0x1027edd8], 0
je 0x10203d90
mov eax, dword [0x1027edd8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [0x1027edd8], 0
mov ecx, dword [0x1027edd4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [0x1027edd8], eax
cmp dword [0x1027edd8], 0xffffffff
jne 0x10203db3
xor eax, eax
jmp 0x10203df5
jmp 0x10203de7
mov eax, dword [0x1027edd4]
push eax
mov ecx, dword [0x1027edd8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10203de7
mov edx, dword [0x1027edd8]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [0x1027edd8], 0
xor eax, eax
jmp 0x10203df5
mov eax, dword [0x1027edd4]
add eax, 0x2c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10204800
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x10204885
cmp dword [0x1027eff4], 0
jne 0x10204841
push 0x190
push str.f:_vs70builds3077_vccrtbldcrt_srcwild.c
push 2
push 0x354
call sym.MSVCR71D.dll__malloc_dbg
add esp, 0x10
mov dword [0x1027eff4], eax
cmp dword [0x1027eff4], 0
jne 0x10204841
xor eax, eax
jmp 0x102048c5
cmp dword [0x1027eff0], 0
je 0x10204860
mov eax, dword [0x1027eff0]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [0x1027eff0], 0
mov ecx, dword [0x1027eff4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [0x1027eff0], eax
cmp dword [0x1027eff0], 0xffffffff
jne 0x10204883
xor eax, eax
jmp 0x102048c5
jmp 0x102048b7
mov eax, dword [0x1027eff4]
push eax
mov ecx, dword [0x1027eff0]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x102048b7
mov edx, dword [0x1027eff0]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [0x1027eff0], 0
xor eax, eax
jmp 0x102048c5
mov eax, dword [0x1027eff4]
add eax, 0x2c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10204a10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x11b0
call fcn.10201a90
mov eax, dword [0x1027c570]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10a4], 0
push 0x1090
lea eax, [ebp - 0x10a0]
push eax
push str.__MSVCRT_HEAP_SELECT
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x10204be6
lea ecx, [ebp - 0x10a0]
mov dword [ebp - 8], ecx
jmp 0x10204a62
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x10204a92
mov edx, dword [ebp - 8]
movsx eax, byte [edx]
cmp eax, 0x61
jl 0x10204a90
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx]
cmp edx, 0x7a
jg 0x10204a90
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
sub ecx, 0x20
mov edx, dword [ebp - 8]
mov byte [edx], cl
jmp 0x10204a59
push 0x16
lea eax, [ebp - 0x10a0]
push eax
push str.__GLOBAL_HEAP_SELECTED
call sym.MSVCR71D.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x10204aba
lea ecx, [ebp - 0x10a0]
mov dword [ebp - 0x10a4], ecx
jmp 0x10204b35
mov byte [ebp - 0x10ac], 0
push 0x104
lea edx, [ebp - 0x11b0]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x11b0]
mov dword [ebp - 8], eax
jmp 0x10204ae9
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
movsx eax, byte [edx]
test eax, eax
je 0x10204b19
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx]
cmp edx, 0x61
jl 0x10204b17
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
cmp ecx, 0x7a
jg 0x10204b17
mov edx, dword [ebp - 8]
movsx eax, byte [edx]
sub eax, 0x20
mov ecx, dword [ebp - 8]
mov byte [ecx], al
jmp 0x10204ae0
lea edx, [ebp - 0x11b0]
push edx
lea eax, [ebp - 0x10a0]
push eax
call sym.MSVCR71D.dll_strstr
add esp, 8
mov dword [ebp - 0x10a4], eax
cmp dword [ebp - 0x10a4], 0
je 0x10204be6
push 0x2c
mov ecx, dword [ebp - 0x10a4]
push ecx
call sym.MSVCR71D.dll_strchr
add esp, 8
mov dword [ebp - 0x10a4], eax
cmp dword [ebp - 0x10a4], 0
je 0x10204be6
mov edx, dword [ebp - 0x10a4]
add edx, 1
mov dword [ebp - 0x10a4], edx
mov eax, dword [ebp - 0x10a4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx]
cmp edx, 0x20
jne 0x10204b94
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x10204b7e
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx]
cmp edx, 0x30
jl 0x10204bcf
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
cmp ecx, 0x39
jg 0x10204bcf
mov edx, dword [ebp - 4]
imul edx, edx, 0xa
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
lea edx, [edx + ecx - 0x30]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x10204b9b
cmp dword [ebp - 4], 2
je 0x10204be1
cmp dword [ebp - 4], 3
je 0x10204be1
cmp dword [ebp - 4], 1
jne 0x10204be6
mov eax, dword [ebp - 4]
jmp 0x10204c20
cmp dword [sym.MSVCR71D.dll__osplatform], 2
jne 0x10204bff
cmp dword [sym.MSVCR71D.dll__winmajor], 5
jb 0x10204bff
mov eax, 1
jmp 0x10204c20
lea ecx, [ebp - 0xc]
push ecx
call fcn.102049b0
add esp, 4
movzx edx, byte [ebp - 0xc]
cmp edx, 6
jl 0x10204c1b
mov eax, 3
jmp 0x10204c20
mov eax, 2
mov ecx, dword [ebp - 0x10]
call fcn.1020cd80
mov esp, ebp
pop ebp
ret
Function at 0x1020c140
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
cmp dword [0x1027f028], 0
jne 0x1020c1fb
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x1020c192
push str.MessageBoxA
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1027f028], eax
cmp dword [0x1027f028], 0
jne 0x1020c199
xor eax, eax
jmp 0x1020c2aa
push str.GetActiveWindow
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1027f02c], eax
push str.GetLastActivePopup
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1027f030], eax
cmp dword [sym.MSVCR71D.dll__osplatform], 2
jne 0x1020c1fb
push str.GetUserObjectInformationA
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1027f038], eax
cmp dword [0x1027f038], 0
je 0x1020c1fb
push str.GetProcessWindowStation
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1027f034], eax
cmp dword [0x1027f034], 0
je 0x1020c23c
call dword [0x1027f034]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1020c235
lea edx, [ebp - 0x18]
push edx
push 0xc
lea eax, [ebp - 0xc]
push eax
push 1
mov ecx, dword [ebp - 0x10]
push ecx
call dword [0x1027f038]
test eax, eax
je 0x1020c235
mov edx, dword [ebp - 4]
and edx, 1
jne 0x1020c23c
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0
je 0x1020c266
cmp dword [sym.MSVCR71D.dll__winmajor], 4
jb 0x1020c258
mov eax, dword [ebp + 0x10]
or eax, 0x200000
mov dword [ebp + 0x10], eax
jmp 0x1020c264
mov ecx, dword [ebp + 0x10]
or ecx, 0x40000
mov dword [ebp + 0x10], ecx
jmp 0x1020c294
cmp dword [0x1027f02c], 0
je 0x1020c278
call dword [0x1027f02c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1020c294
cmp dword [0x1027f030], 0
je 0x1020c294
mov edx, dword [ebp - 0x14]
push edx
call dword [0x1027f030]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [0x1027f028]
mov esp, ebp
pop ebp
ret
Function at 0x1020cd80
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1027c570]
jne 0x1020cd89
ret
jmp fcn.1020cd90
Function at 0x102128b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1027c570]
mov dword [ebp - 8], eax
mov byte [ebp - 0xa], 0
push 6
lea eax, [ebp - 0x10]
push eax
push 0x1004
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x102128e4
mov dword [ebp - 4], 0xffffffff
jmp 0x102128f3
lea edx, [ebp - 0x10]
push edx
call sym.MSVCR71D.dll_atol
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.1020cd80
mov esp, ebp
pop ebp
ret

Function at 0x1021afe0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, 4
call fcn.10201a90
mov dword [ebp - 0x64], esp
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x10], eax
push 0x1c
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1021b014
xor eax, eax
jmp 0x1021b122
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x60], eax
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
sub eax, 1
not eax
and eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [sym.MSVCR71D.dll__osplatform]
sub ecx, 1
neg ecx
sbb ecx, ecx
and ecx, 0xfffffff1
add ecx, 0x11
imul ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x60]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 8]
jae 0x1021b067
xor eax, eax
jmp 0x1021b122
cmp dword [sym.MSVCR71D.dll__osplatform], 1
je 0x1021b0ed
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x5c], eax
push 0x1c
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1021b091
xor eax, eax
jmp 0x1021b122
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x4c]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x48]
and ecx, 0x1000
je 0x1021b076
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 0x44]
and eax, 0x100
je 0x1021b0bc
mov eax, 1
jmp 0x1021b122
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x5c]
jae 0x1021b0c8
xor eax, eax
jmp 0x1021b122
mov edx, dword [ebp - 0x5c]
cmp edx, dword [ebp - 8]
jae 0x1021b0d6
mov eax, dword [ebp - 8]
mov dword [ebp - 0x5c], eax
push 4
push 0x1000
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
jmp 0x1021b0f3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x5c], eax
mov ecx, dword [sym.MSVCR71D.dll__osplatform]
sub ecx, 1
neg ecx
sbb ecx, ecx
and ecx, 0x103
add ecx, 1
mov dword [ebp - 4], ecx
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x64]
mov esp, ebp
pop ebp
ret