joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c219
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x101200c]
push ebx
push esi
push edi
push 2
pop edi
cmp dword [0x1016bd8], edi
mov esi, 0x104
mov dword [ebp - 4], eax
lea eax, [ebp - 0x108]
push esi
jne 0x100c1cc
push 0x1005b2c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov dword [ebp - 0x21c], edi
jmp 0x100c1dd
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x21c], 1
xor eax, eax
xor edi, edi
cmp dword [ebp + 8], edi
setne al
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 0x1005b44
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
cmp dword [ebp + 8], edi
mov eax, reloc.KERNEL32.dll_GetVersionExA
jne 0x100c215
mov eax, 0x100247c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x210]
push ecx
push edi
push 0x20006
push edi
push edi
push edi
push eax
push 0x80000000
call ebx
test eax, eax
jne 0x100c373
push esi
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
add eax, 0x40d
push eax
push dword [0x1016c8c]
call dword [sym.imp.USER32.dll_LoadStringA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push edi
push edi
push dword [ebp - 0x210]
call esi
push 4
lea eax, [ebp - 0x218]
push eax
push 4
push edi
push 0x1005b20
push dword [ebp - 0x210]
mov dword [ebp - 0x218], 2
call esi
push 1
push 0x10025a4
push 1
push edi
push 0x1005b10
push dword [ebp - 0x210]
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push 0x1005b04
push dword [ebp - 0x210]
call ebx
test eax, eax
jne 0x100c312
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x21c]
push edi
push edi
push dword [ebp - 0x214]
call esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push 0x1002281
push dword [ebp - 0x210]
call ebx
test eax, eax
jne 0x100c367
cmp dword [ebp + 8], edi
je 0x100c348
push 0x2e
push 0x1005aa8
jmp 0x100c34f
push 0x2c
push 0x1005ad8
push 1
push edi
push edi
push dword [ebp - 0x214]
call esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100d528
leave
ret 4
Function at 0x100c353
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x101200c]
push ebx
push esi
push edi
push 2
pop edi
cmp dword [0x1016bd8], edi
mov esi, 0x104
mov dword [ebp - 4], eax
lea eax, [ebp - 0x108]
push esi
jne 0x100c1cc
push 0x1005b2c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov dword [ebp - 0x21c], edi
jmp 0x100c1dd
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x21c], 1
xor eax, eax
xor edi, edi
cmp dword [ebp + 8], edi
setne al
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 0x1005b44
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
cmp dword [ebp + 8], edi
mov eax, reloc.KERNEL32.dll_GetVersionExA
jne 0x100c215
mov eax, 0x100247c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x210]
push ecx
push edi
push 0x20006
push edi
push edi
push edi
push eax
push 0x80000000
call ebx
test eax, eax
jne 0x100c373
push esi
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
add eax, 0x40d
push eax
push dword [0x1016c8c]
call dword [sym.imp.USER32.dll_LoadStringA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push edi
push edi
push dword [ebp - 0x210]
call esi
push 4
lea eax, [ebp - 0x218]
push eax
push 4
push edi
push 0x1005b20
push dword [ebp - 0x210]
mov dword [ebp - 0x218], 2
call esi
push 1
push 0x10025a4
push 1
push edi
push 0x1005b10
push dword [ebp - 0x210]
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push 0x1005b04
push dword [ebp - 0x210]
call ebx
test eax, eax
jne 0x100c312
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x21c]
push edi
push edi
push dword [ebp - 0x214]
call esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push 0x1002281
push dword [ebp - 0x210]
call ebx
test eax, eax
jne 0x100c367
cmp dword [ebp + 8], edi
je 0x100c348
push 0x2e
push 0x1005aa8
jmp 0x100c34f
push 0x2c
push 0x1005ad8
push 1
push edi
push edi
push dword [ebp - 0x214]
call esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100d528
leave
ret 4
Function at 0x100c56a
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x101200c]
push ebx
push edi
mov dword [ebp - 4], eax
call fcn.0100bf4f
xor edi, edi
test eax, eax
mov ebx, 0x104
jne 0x100c4f5
test byte [0x1016c5c], 2
je 0x100c4ea
push ebx
push 0x30
push 0x40f
push edi
call fcn.0100d141
sub eax, 7
neg eax
sbb eax, eax
inc eax
jmp 0x100c4ed
xor eax, eax
inc eax
cmp eax, edi
jne 0x100c63d
mov eax, dword [0x1016c6c]
dec eax
je 0x100c50b
dec eax
jne 0x100c649
mov eax, 0x404
jmp 0x100c510
mov eax, 0x3ee
push 0x30
push 4
push eax
push edi
call fcn.0100d141
cmp eax, 7
je 0x100c63d
call fcn.0100b28b
test eax, eax
je 0x100c63d
call fcn.0100cf66
test eax, eax
jne 0x100c559
push 1
push 0x1005d30
call fcn.0100d0a2
push edi
push 0x10
push 0x3fb
push edi
call fcn.0100d141
jmp 0x100c649
push esi
call fcn.0100bcd8
push dword [0x1016bc4]
mov esi, 0x10169b8
push esi
push 0x100597c
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_wnsprintfA]
lea eax, [ebp - 0x108]
push eax
call ebx
add esp, 0x14
cmp dword [0x1016c60], edi
jne 0x100c5f2
call fcn.0100bda6
push edi
push 0xd
push edi
push 0x10167b0
push esi
push 0x10058d0
lea eax, [ebp - 0x108]
push eax
push edi
call dword [0x1016c74]
push 0x4c
push 0x10025a4
push 0x1005830
lea eax, [ebp - 0x108]
push eax
push 0x1005948
lea eax, [ebp - 0x310]
push 0x208
push eax
call ebx
add esp, 0x1c
push edi
lea eax, [ebp - 0x310]
push eax
push edi
push edi
call dword [0x1016c78]
call fcn.0100bf24
call fcn.0100bbc7
jmp 0x100c60f
push edi
push 0xd
push edi
push 0x10167b0
push esi
push 0x10058ec
lea eax, [ebp - 0x108]
push eax
push edi
call dword [0x1016c74]
call fcn.0100c436
test byte [0x1016c5c], 2
pop esi
je 0x100c625
push 1
call fcn.0100b243
cmp dword [0x1016c60], edi
je 0x100c638
call fcn.0100c46c
push edi
call fcn.0100aa13
xor eax, eax
inc eax
jmp 0x100c64b
push 1
push 0x1005d18
call fcn.0100d0a2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.0100d528
leave
ret
Function at 0x100c6a6
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x101200c]
mov ecx, dword [ebp + 0xc]
push esi
lea edx, [ebp - 0x118]
push edx
push 0x2000000
xor esi, esi
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x124], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
mov dword [ebp - 0x120], eax
jne 0x100c78e
push ebx
push edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push esi
push dword [ebp - 0x118]
mov ebx, 0x105
mov dword [ebp - 0x110], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp eax, esi
mov dword [ebp - 0x120], eax
jne 0x100c71a
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
jmp 0x100c6f5
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x118]
call fcn.0100c65c
push dword [ebp - 0x110]
dec dword [ebp - 0x114]
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x114]
push dword [ebp - 0x118]
call edi
test eax, eax
je 0x100c6e3
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x124], esi
je 0x100c748
push dword [ebp - 0x124]
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 0x120], eax
jmp 0x100c78c
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
jmp 0x100c767
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x100c78c
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
push dword [ebp - 0x11c]
mov dword [ebp - 0x110], ebx
call edi
test eax, eax
je 0x100c750
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x120]
pop esi
call fcn.0100d528
leave
ret 8

Function at 0x100c7cf
Capabilities:
Create process on windows
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x1016bd8], 2
jne 0x100c80b
mov eax, dword [0x1012000]
cmp eax, 0xffffffff
jne 0x100c7e2
push 0x1005d88
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x100c7db
push 0x1005d6c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x100c7dd
xor eax, eax
mov dword [0x1012000], eax
test eax, eax
je 0x100c7e9
pop ebp
jmp eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
pop ebp
ret 8
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
Function at 0x100c95a
Capabilities:
Get common file path
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x101200c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x224]
push eax
push 0x20019
xor esi, esi
push esi
push 0x10054c4
push 0x80000002
mov dword [ebp - 0x220], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100c9e6
mov byte [ebp - 8], al
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x228]
push eax
push esi
push 0x1005510
push dword [ebp - 0x224]
mov dword [ebp - 0x218], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100c9da
cmp dword [ebp - 0x228], 2
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push edi
mov esi, 0x105
jne 0x100c949
push 0x41
pop ecx
lea edi, [ebp - 0x214]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push esi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push eax
call ebx
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 4
jmp 0x100c952
mov eax, dword [ebp - 0x218]
sub eax, 5
mov ecx, esi
sub ecx, eax
push ecx
mov dword [ebp - 0x218], eax
push 0x1005910
lea eax, [ebp + eax - 0x10c]
push eax
call ebx
xor edi, edi
inc edi
cmp dword [0x1016bd8], edi
jne 0x100c98c
push dword [ebp + 0xc]
push dword [ebp - 0x21c]
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x10c]
push eax
push esi
lea eax, [ebp - 0x214]
push eax
push 0x10025a4
push dword [ebp - 0x21c]
push 0x1005900
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, edi
jbe 0x100c9d8
push 0x1005a5c
lea eax, [ebp - 0x214]
push eax
mov byte [ebp - 0x212], 0
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x100c9d8
mov dword [ebp - 0x220], edi
pop edi
pop ebx
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x220]
pop esi
call fcn.0100d528
leave
ret 8
Function at 0x100cb2c
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x101200c]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x20]
push eax
push 1
xor ebx, ebx
push ebx
push dword [0x1016bc0]
mov dword [ebp - 0x2c], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100cb44
push edi
push 0x14
cmp esi, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop edi
je 0x100cb0f
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push 0x1004fd0
push dword [ebp - 0x20]
mov dword [ebp - 0x24], edi
mov byte [ebp - 8], bl
call esi
push dword [ebp - 0x2c]
lea eax, [ebp - 0x1c]
push eax
call fcn.0100ca44
cmp dword [ebp - 0x28], ebx
je 0x100cb3a
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push 0x1004fe0
push dword [ebp - 0x20]
mov dword [ebp - 0x24], edi
mov byte [ebp - 8], bl
call esi
push dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
push eax
call fcn.0100ca44
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0100d528
leave
ret 8

Function at 0x100ccbc
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x15c
mov eax, dword [0x101200c]
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
cmp ebx, esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x158], edi
mov dword [ebp - 0x154], esi
je 0x100cc49
mov byte [ebx], 0
cmp edi, esi
je 0x100cc51
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ecx
push 0x10053b8
push 0x10024a4
lea eax, [ebp - 0x148]
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
lea eax, [ebp - 0x14c]
push eax
xor edi, edi
inc edi
push edi
push esi
lea eax, [ebp - 0x148]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100cd35
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x15c]
push eax
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x1005414
push dword [ebp - 0x14c]
mov dword [ebp - 0x150], 4
call esi
test eax, eax
jne 0x100cd29
cmp dword [ebp - 0x15c], edi
jne 0x100cd29
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0x10023cc
push dword [ebp - 0x14c]
mov dword [ebp - 0x150], 0x40
call esi
test eax, eax
jne 0x100cd29
cmp dword [ebp - 0x158], eax
je 0x100cd11
push dword [ebp - 0x158]
lea eax, [ebp - 0x44]
push eax
call fcn.0100ca44
test ebx, ebx
je 0x100cd23
push dword [ebp + 0x14]
lea eax, [ebp - 0x44]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov dword [ebp - 0x154], edi
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x154]
pop edi
pop esi
pop ebx
call fcn.0100d528
leave
ret 0x10
Function at 0x100d115
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [0x1016c88], 0xffffffff
mov eax, dword [0x101200c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
je 0x100d130
cmp dword [ebp + 0xc], 0
je 0x100d0e1
mov byte [ebp - 0x104], 0xd
mov byte [ebp - 0x103], 0xa
mov dword [ebp - 0x108], 2
jmp 0x100d0e8
and dword [ebp - 0x108], 0
mov ecx, dword [ebp - 0x108]
mov edx, 0x100
sub edx, ecx
push edx
push eax
lea eax, [ebp + ecx - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x104]
push eax
push dword [0x1016c88]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
call fcn.0100d528
leave
ret 8

Function at 0x100d795
Capabilities:
Query environment variable

Disassembly:
push 0x60
push 0x1005e20
call fcn.0100e504
and dword [ebp - 4], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or dword [ebp - 4], 0xffffffff
mov ebx, 0x94
push ebx
push 0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x100d879
mov dword [esi], ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push esi
test eax, eax
jne 0x100d714
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100d879
mov eax, dword [esi + 0x10]
mov dword [0x10170dc], eax
mov eax, dword [esi + 4]
mov dword [0x10170e8], eax
mov eax, dword [esi + 8]
mov dword [0x10170ec], eax
mov eax, dword [esi + 0xc]
and eax, 0x7fff
mov dword [0x10170e0], eax
xor ebx, ebx
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [0x10170dc], 2
je 0x100d755
or byte [0x10170e1], 0x80
mov eax, dword [0x10170e8]
shl eax, 8
add eax, dword [0x10170ec]
mov dword [0x10170e4], eax
call fcn.0100d657
mov dword [ebp - 0x1c], eax
push ebx
call fcn.0100e4a5
pop ecx
test eax, eax
jne 0x100d79c
cmp dword [0x10170cc], 1
jne 0x100d789
call fcn.0100dc77
push 0x1c
call fcn.0100db11
push 0xff
call fcn.0100d970
pop ecx
pop ecx
mov dword [ebp - 4], 1
call fcn.0100e2be
test eax, eax
jge 0x100d7b4
push 0x1b
call fcn.0100d628
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1017a14], eax
call fcn.0100e191
mov dword [0x10170c4], eax
call fcn.0100e0e9
test eax, eax
jge 0x100d7da
push 8
call fcn.0100d628
pop ecx
call fcn.0100de91
test eax, eax
jge 0x100d7eb
push 9
call fcn.0100d628
pop ecx
call fcn.0100d9ca
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x100d7fe
push eax
call fcn.0100d628
pop ecx
call fcn.0100de2d
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x100d812
movzx eax, word [ebp - 0x40]
jmp 0x100d815
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push ebx
push 0x1000000
call fcn.01007eb3
mov esi, eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x100d834
push esi
call fcn.0100daaa
call fcn.0100dae2
jmp 0x100d866
or dword [ebp - 4], 0xffffffff
mov eax, esi
jmp 0x100d87e
mov eax, 0xff
call fcn.0100e53f
ret
Function at 0x100dd37
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [0x1012138]
push ebx
mov ecx, 0x10120b8
push esi
cmp dword [ecx], edx
je 0x100dcde
lea esi, [eax + eax*2]
add ecx, 0xc
lea esi, [esi*4 + 0x10120b8]
cmp ecx, esi
jb 0x100dcc9
lea eax, [eax + eax*2]
lea eax, [eax*4 + 0x10120b8]
cmp ecx, eax
jae 0x100dcf0
cmp dword [ecx], edx
je 0x100dcf2
xor ecx, ecx
test ecx, ecx
je 0x100de1b
mov ebx, dword [ecx + 8]
test ebx, ebx
je 0x100de1b
cmp ebx, 5
jne 0x100dd16
and dword [ecx + 8], 0
xor eax, eax
inc eax
jmp 0x100de24
cmp ebx, 1
je 0x100de16
mov eax, dword [0x1017438]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [0x1017438], eax
mov eax, dword [ecx + 4]
cmp eax, 8
jne 0x100de06
mov eax, dword [0x1012130]
mov edx, dword [0x1012134]
add edx, eax
cmp eax, edx
jge 0x100dd61
lea esi, [eax + eax*2]
lea esi, [esi*4 + 0x10120c0]
sub edx, eax
and dword [esi], 0
add esi, 0xc
dec edx
jne 0x100dd58
mov ecx, dword [ecx]
cmp ecx, 0xc000008e
mov esi, dword [0x101213c]
jne 0x100dd7d
mov dword [0x101213c], 0x83
jmp 0x100ddf3
cmp ecx, 0xc0000090
jne 0x100dd91
mov dword [0x101213c], 0x81
jmp 0x100ddf3
cmp ecx, 0xc0000091
jne 0x100dda5
mov dword [0x101213c], 0x84
jmp 0x100ddf3
cmp ecx, 0xc0000093
jne 0x100ddb9
mov dword [0x101213c], 0x85
jmp 0x100ddf3
cmp ecx, 0xc000008d
jne 0x100ddcd
mov dword [0x101213c], 0x82
jmp 0x100ddf3
cmp ecx, 0xc000008f
jne 0x100dde1
mov dword [0x101213c], 0x86
jmp 0x100ddf3
cmp ecx, 0xc0000092
jne 0x100ddf3
mov dword [0x101213c], 0x8a
push dword [0x101213c]
push 8
call ebx
pop ecx
mov dword [0x101213c], esi
jmp 0x100de0d
and dword [ecx + 8], 0
push eax
call ebx
mov eax, dword [ebp + 8]
pop ecx
mov dword [0x1017438], eax
or eax, 0xffffffff
jmp 0x100de24
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
pop esi
pop ebx
pop ebp
ret

Function at 0x100ee2a
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
push ebx
call fcn.0101000a
mov edi, eax
test edi, edi
pop ecx
jne 0x100ee43
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esi + 0x3e8]
cmp eax, 0xea60
jbe 0x100ee3c
or eax, 0xffffffff
cmp eax, 0xffffffff
mov esi, eax
jne 0x100ee18
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x101000a
Capabilities:
Check os version
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], 0xffffffe0
ja 0x1010082
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push edi
mov eax, dword [0x10178e4]
cmp eax, 1
mov edi, dword [ebp + 8]
jne 0x101003b
test edi, edi
je 0x1010035
mov eax, edi
jmp 0x1010038
xor eax, eax
inc eax
push eax
jmp 0x101005b
cmp eax, 3
jne 0x101004b
push edi
call fcn.0100ffea
test eax, eax
pop ecx
jne 0x1010065
cmp dword [ebp + 8], 0
jne 0x1010054
xor edi, edi
inc edi
add edi, 0xf
and edi, 0xfffffff0
push edi
push 0
push dword [0x10178e0]
call ebx
mov esi, eax
test esi, esi
jne 0x1010080
cmp dword [0x10175e0], eax
je 0x1010080
push dword [ebp + 8]
call fcn.010107b6
test eax, eax
pop ecx
jne 0x1010020
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
ret