joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002a5fe
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002a620
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push 1
push dword [ebp - 8]
call fcn.1002a68a
pop ecx
pop ecx
jmp 0x1002a686
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002a668
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1002a666
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x1002a686
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002a686
push 0xd1e
push 0x1c73
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
mov esp, ebp
pop ebp
ret

Function at 0x1002c878
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1002c8e1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002c8cb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1002c8c9
push 0
push 0x1ff7
push 0xa5f
push 0x167f
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
jmp 0x1002c8df
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002c8df
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1002c907
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
push 0x5b37
push 0x33cf
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.1002ab67
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x1002ce85
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002cedf
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002ced3
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002ced1
push 0
push 0xa1d
push 0x2025
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x1002cedd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x1002cef8
push 0x25d4
push 0xa1e
push 0
push 0x5a33
call fcn.1002cb5b
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10030b37
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100686d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push esi
push edi
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10030c45
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10030c29
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call fcn.100274f4
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x3c]
call fcn.100213c1
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
xor edx, edx
push 2
pop ecx
div ecx
test edx, edx
jne 0x10030c01
lea eax, [ebp - 0x60]
push eax
call fcn.10024f1d
pop ecx
mov esi, eax
lea edi, [ebp - 0x48]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x48]
lea edi, [ebp - 0x54]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call fcn.1002750e
mov dword [ebp - 0x24], eax
push 1
lea eax, [ebp - 0x54]
push eax
push 0x6549
lea eax, [ebp - 0x24]
push eax
push 0x5421
lea eax, [ebp - 0x3c]
push eax
push 1
lea eax, [ebp - 0x14]
push eax
call fcn.10030982
add esp, 0x20
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x28]
call fcn.100314fe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.100314f9
jmp 0x10030c70
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x10030c70
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
push 0
push 0x6957
push 0x4e08
push dword [ebp - 0x30]
push 0x33ac
call fcn.100296d3
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10034e9f
Capabilities:
Get common file path
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10034ed2
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10034ec6
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x10034ed0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x10034eef
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0x64b1
push 0x40ec
push 0
call fcn.10041e06
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10035c53
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10035c6b
push 1
call fcn.10035ce7
pop ecx
jmp 0x10035ce3
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10035cb9
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10035cb7
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x10035ce3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10035ce3
push 0x3f77
push 0
push 0x6074
call fcn.1004be23
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x100360a6
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1003610c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100360f3
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100360f1
push 0
push 0x15aa
push 0x5a4e
push 1
push 0x1aa5
call fcn.10036688
add esp, 0x14
jmp 0x1003610a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x1003613a
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10036126
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1003613a
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1003613a
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esp, ebp
pop ebp
ret

Function at 0x100365fa
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10036618
push 0x24f5
push 1
call fcn.1003666e
pop ecx
pop ecx
jmp 0x1003666a
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1003664a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x1003666a
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1003666a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esp, ebp
pop ebp
ret
Function at 0x10036dca
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10036dfc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push 0
push 0x3d52
push 0x552c
push 0x298c
push dword [ebp - 8]
call fcn.1004c627
add esp, 0x14
jmp 0x10036e55
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10036e37
mov byte [ebp - 1], 0
push 0x7f2f
push 1
push 1
push 0x9e
push 0x5dd3
lea eax, [ebp - 1]
push eax
call fcn.10036527
add esp, 0x18
jmp 0x10036e55
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10036e55
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov esp, ebp
pop ebp
ret

Function at 0x10037bc6
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10037c4c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10037c1f
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10037c1d
push 0x130f
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x10037c4a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.100214c8
mov dword [eax], 0x61f6656
jmp 0x10037c92
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x2c]
push 0
push dword [ebp - 0x30]
push 0x551e
push dword [ebp - 0x34]
push 0x3de
push dword [ebp - 0x38]
push 0x2106
push dword [ebp - 0x3c]
call fcn.1003738e
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x100405a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100405cd
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
push 1
push dword [ebp - 4]
push 0x5687
push 0x277b
call fcn.10040617
add esp, 0x10
jmp 0x10040613
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10040609
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10040607
push 0
push 0xb48
call fcn.10040ad7
pop ecx
pop ecx
jmp 0x10040613
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esp, ebp
pop ebp
ret
Function at 0x10040c56
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10040d39
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10040cdf
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10040cb2
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xfffffff0
jle 0x10040cdd
mov dword [ebp - 0x20], 0xd94543be
push 0
push 0x4c23
lea eax, [ebp - 0x20]
push eax
push 1
push 0x5f89
call fcn.10043d03
add esp, 0x14
jmp 0x10040ca7
jmp 0x10040d34
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push dword [eax]
mov ecx, dword [ebp - 0xc]
call fcn.100214c8
cmp dword [eax], 0
jne 0x10040d1e
mov dword [ebp - 0x10], 1
jmp 0x10040d22
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x40]
push dword [eax]
mov ecx, dword [ebp - 0xc]
call fcn.100214c8
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
jmp 0x10040dda
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x10040da8
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10040d89
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x10040da6
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x58]
call fcn.100214c8
mov dword [eax], 0x1928c176
jmp 0x10040d7e
jmp 0x10040dda
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
movzx eax, byte [eax]
test eax, eax
je 0x10040dda
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esp, ebp
pop ebp
ret
Function at 0x1004c645
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1004c6d2
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1004c6b2
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
add ecx, dword [eax]
mov eax, dword [ebp - 0x28]
mov dword [eax], ecx
jmp 0x1004c6d0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1004c6d0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x1004c6da
push 1
call fcn.10034f5f
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10062e8f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006c760]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10054cc8
mov dword [ebp - 0x14], eax
cmp dword [0x1060f7dc], esi
jne 0x10062f82
push 0x800
push esi
push 0x10006774
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10062f0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10063062
push esi
push esi
push 0x10006774
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10063062
push 0x1000678c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10063062
push eax
call ebx
push 0x10006798
push edi
mov dword [0x1060f7dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100067a8
push edi
mov dword [0x1060f7e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100067bc
push edi
mov dword [0x1060f7e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1060f7ec], eax
test eax, eax
je 0x10062f7f
push 0x100067d8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1060f7e8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10062fa7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10062f9a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10062fbc
push 4
pop eax
jmp 0x10063064
cmp dword [ebp - 0x14], esi
je 0x10062fbc
push dword [0x1060f7dc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10062fa1
mov eax, dword [0x1060f7e8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1006301a
cmp dword [0x1060f7ec], edi
je 0x1006301a
push eax
call ebx
push dword [0x1060f7ec]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1006301a
test eax, eax
je 0x1006301a
call ecx
test eax, eax
je 0x1006300f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1006300f
test byte [ebp - 8], 1
jne 0x1006301a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1006304a
mov eax, dword [0x1060f7e0]
cmp eax, edi
je 0x10063047
push eax
call ebx
test eax, eax
je 0x10063047
call eax
mov esi, eax
test esi, esi
je 0x10063047
mov eax, dword [0x1060f7e4]
cmp eax, edi
je 0x10063047
push eax
call ebx
test eax, eax
je 0x10063047
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1060f7dc]
call ebx
test eax, eax
je 0x10063062
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10063064
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10052086
mov esp, ebp
pop ebp
ret
Function at 0x1001a5c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1003020]
jne 0x1001a65
ret
jmp 0x1001a6a
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x1003020]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x100305c]
test eax, eax
je 0x1001a8e
call eax
cmp dword [0x1003060], 0
je 0x1001ad5
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x1003060]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.01001a5c
add ebp, 0x2a8
leave
ret
Function at 0x1001ba3
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x10011a0
call fcn.01001e78
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or edi, 0xffffffff
mov dword [ebp - 4], edi
cmp word [0x1000000], 0x5a4d
jne 0x1001bf6
mov eax, dword [0x100003c]
lea eax, [eax + 0x1000000]
cmp dword [eax], 0x4550
jne 0x1001bf6
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x1001c0e
cmp ecx, 0x20b
je 0x1001bfb
mov dword [ebp - 0x1c], ebx
jmp 0x1001c22
cmp dword [eax + 0x84], 0xe
jbe 0x1001bf6
xor ecx, ecx
cmp dword [eax + 0xf8], ebx
jmp 0x1001c1c
cmp dword [eax + 0x74], 0xe
jbe 0x1001bf6
xor ecx, ecx
cmp dword [eax + 0xe8], ebx
setne cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 1
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
mov dword [0x1003064], edi
mov dword [0x1003068], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1003058]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1003054]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100306c], eax
call fcn.01001e72
cmp dword [0x1003040], ebx
jne 0x1001c7f
push fcn.01001e72
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01001e60
push 0x1003010
push 0x100300c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1003050]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x100304c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x1003008
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp byte [eax], 0x22
jne 0x1001d0a
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x1001cea
cmp cl, 0x22
jne 0x1001cdb
cmp byte [eax], 0x22
jne 0x1001cf3
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x1001cfe
cmp cl, 0x20
jbe 0x1001cef
test byte [ebp - 0x54], 1
je 0x1001d15
movzx ecx, word [ebp - 0x50]
jmp 0x1001d18
cmp byte [eax], 0x20
jbe 0x1001cf3
inc eax
mov dword [ebp - 0x20], eax
jmp 0x1001d0a
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call fcn.01001965
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x1001d36
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x1001d72
mov eax, esi
jmp 0x1001d86
call fcn.01001eb3
ret