joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001ba50
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x1003a1d0]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x198], eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 0x20]
push eax
mov dword [esi], 0x100343bc
call edi
lea ecx, [esi + 0x40]
push ecx
call edi
xor ebx, ebx
lea edx, [esp + 0xc]
push edx
push 0x202
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], 5
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [esi + 4], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov byte [esi + 8], bl
xor eax, eax
lea ecx, [esi + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov ecx, dword [esp + 0x19c]
or eax, 1
mov dword [esi + 0x1c], eax
pop edi
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x6c], 0x80
mov eax, esi
pop esi
pop ebx
call fcn.1001fde5
add esp, 0x194
ret

Function at 0x1001be50
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
push esi
xor eax, eax
push eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push eax
mov esi, ecx
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
mov edx, dword [eax + 0x14]
push 1
lea ecx, [eax + 0x1c]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x1001beb0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x1001beb0
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx]
call dword [eax + 8]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.1001bc20
xor eax, eax
pop esi
add esp, 8
ret 8
mov eax, 1
pop esi
add esp, 8
ret 8

Function at 0x1001c650
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x6c
mov eax, dword [0x1003a1d0]
push esi
push 0
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
push eax
push 2
mov esi, ecx
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push 4
push str.ECHO
lea ecx, [esi + 0x40024]
mov dword [esp + 0x20], 0x64
call fcn.1001eb20
test eax, eax
je 0x1001c6ef
movzx ecx, word [esp + 4]
push edi
mov edi, dword [esi + 0x40610]
mov eax, ecx
cdq
add edi, eax
mov eax, dword [esi + 0x40614]
adc eax, edx
push 0x10
mov dword [esi + 0x40614], eax
mov eax, dword [esp + 0x80]
push eax
push 0
push ecx
lea ecx, [esp + 0x1c]
mov dword [esi + 0x40610], edi
mov edx, dword [esi + 0x4064c]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_sendto]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop edi
pop esi
mov eax, ecx
mov ecx, dword [esp + 0x68]
call fcn.1001fde5
add esp, 0x6c
ret 8
mov ecx, dword [esp + 0x6c]
xor eax, eax
pop esi
call fcn.1001fde5
add esp, 0x6c
ret 8
Function at 0x1001cb10
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002d700
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0x10
or ebx, 0xffffffff
mov dword [ebp - 0x14], edi
jmp 0x1001cb50
mov eax, dword [esi + 0x405d4]
test eax, eax
je 0x1001cc96
test edi, edi
mov dword [ebp - 4], 0
jne 0x1001cbb0
lea ecx, [esi + 0x4061c]
call fcn.1001b9d0
test eax, eax
jne 0x1001cb98
push 0x828
call fcn.100192b4
mov edx, eax
add esp, 4
xor eax, eax
test edx, edx
je 0x1001cb98
mov ecx, 0x20a
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, edx
test eax, eax
mov edi, eax
mov dword [ebp - 0x14], edi
jne 0x1001cbb0
push 0xa
call fcn.10010af0
add esp, 4
mov dword [ebp - 4], ebx
jmp 0x1001cb50
mov edx, dword [esi + 0x4064c]
lea eax, [ebp - 0x1c]
push eax
push edi
push 0
push 0x800
lea ecx, [edi + 0x22]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recvfrom]
test eax, eax
jg 0x1001cc0b
test edi, edi
je 0x1001cc01
mov eax, dword [esi + 0x4061c]
cmp eax, dword [esi + 0x40618]
lea ecx, [esi + 0x4061c]
push edi
jge 0x1001cbf9
call fcn.1001b960
xor edi, edi
mov dword [ebp - 4], ebx
jmp 0x1001cb42
call fcn.10020755
add esp, 4
xor edi, edi
mov dword [ebp - 4], ebx
jmp 0x1001cb42
mov word [edi + 0x20], ax
mov ecx, dword [esi + 0x40608]
movzx eax, ax
cdq
add ecx, eax
mov dword [esi + 0x40608], ecx
adc dword [esi + 0x4060c], edx
mov eax, dword [esi + 0x406a8]
test eax, eax
je 0x1001cc5a
lea ecx, [esi + 0x40030]
call fcn.1001ee00
cmp eax, dword [esi + 0x406a8]
jle 0x1001cc5a
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.1001cac0
mov edi, dword [ebp - 0x14]
mov dword [ebp - 4], ebx
jmp 0x1001cb50
push edi
lea ecx, [esi + 0x40030]
call fcn.1001f1e0
xor edi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], ebx
jmp 0x1001cb50
test edi, edi
je 0x1001ccbe
mov edx, dword [esi + 0x4061c]
cmp edx, dword [esi + 0x40618]
lea ecx, [esi + 0x4061c]
push edi
jge 0x1001ccb6
call fcn.1001b960
jmp 0x1001ccbe
call fcn.10020755
add esp, 4
lea edi, [esi + 0x405dc]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esi + 0x405cc]
dec ecx
push edi
mov dword [esi + 0x405cc], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e4b0
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x1002d82e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x198
mov eax, dword [0x1003a1d0]
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x1a0], eax
push edi
mov dword [esp + 0x10], esi
xor ebp, ebp
lea ecx, [esi + 8]
mov dword [esp + 0x1b0], ebp
mov dword [esi], 0x10034668
call fcn.1001f790
lea ecx, [esi + 0x40024]
mov byte [esp + 0x1b0], 1
call fcn.1001eab0
lea ecx, [esi + 0x40030]
mov byte [esp + 0x1b0], 2
call fcn.1001f0d0
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 0x405b0]
push eax
call ebx
lea eax, [esi + 0x405dc]
push eax
call ebx
lea edi, [esi + 0x405f4]
mov ecx, edi
mov byte [esp + 0x1b0], 5
call fcn.1001cd80
mov dword [edi + 4], eax
mov byte [eax + 0x21], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebp
lea ecx, [esi + 0x40600]
mov byte [esp + 0x1b0], 6
call fcn.1001e9c0
lea eax, [esi + 0x40620]
push eax
call ebx
mov dword [esi + 0x4061c], ebp
mov dword [esi + 0x40638], ebp
mov dword [esi + 0x4063c], ebp
mov dword [esi + 0x40640], ebp
mov dword [esi + 0x40644], ebp
xor ecx, ecx
mov eax, 5
mov dword [esi + 0x40648], eax
mov dword [esi + 0x40618], eax
mov dword [esi + 4], ebp
mov byte [esi + 0x405d0], 6
mov dword [esi + 0x406a8], ebp
mov dword [esi + 0x40020], ebp
mov dword [esi + 0x405d4], ebp
mov dword [esi + 0x405d8], ebp
lea edx, [esi + 0x40650]
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov word [esi + 0x40660], bp
mov dword [esi + 0x4064c], 0xffffffff
mov dword [esi + 0x405cc], ebp
mov ecx, 0x10
xor eax, eax
lea edi, [esi + 0x40662]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov dword [esi + 0x406a4], ebp
push ebp
call fcn.10020ab2
push eax
call fcn.10020a83
add esp, 8
call fcn.10020a90
mov word [esi + 0x405c8], ax
lea eax, [esp + 0x14]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [esp + 0x1a8]
pop edi
mov dword [esi + 0x406ac], ebp
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x198]
pop ebx
call fcn.1001fde5
add esp, 0x1a4
ret
Function at 0x10020e7a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x10020e97
call fcn.100235f6
mov dword [eax], 0x16
xor eax, eax
jmp 0x10020f01
push esi
push 0x8c
push 1
call fcn.10025e0a
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10020eec
push esi
call fcn.100228fc
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x10020eca
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x10020de5
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x10020f00
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.10022c9c
test ebx, ebx
pop ecx
je 0x10020efe
push ebx
call fcn.10023608
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100212fb
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x100213eb
mov eax, 0x94
call fcn.10020760
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10021460
mov ecx, dword [esi + 0x10]
mov dword [0x1003c79c], ecx
mov eax, dword [esi + 4]
mov dword [0x1003c7a8], eax
mov edx, dword [esi + 8]
mov dword [0x1003c7ac], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x1003c7a0], esi
je 0x10021366
or esi, 0x8000
mov dword [0x1003c7a0], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x1003c7a4], eax
call fcn.1002700e
test eax, eax
pop ecx
je 0x10021460
call fcn.10022af6
test eax, eax
jne 0x10021393
call fcn.1002705f
jmp 0x10021460
call fcn.10026f6c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1003ddc4], eax
call fcn.10026e4a
mov dword [0x1003c52c], eax
call fcn.1002692b
test eax, eax
jl 0x100213e4
call fcn.10026da8
test eax, eax
jl 0x100213df
call fcn.10026b75
test eax, eax
jl 0x100213df
push 0
call fcn.10025b3e
test eax, eax
pop ecx
jne 0x100213df
inc dword [0x1003c528]
jmp 0x10021471
call fcn.10026b29
call fcn.100228df
jmp 0x10021389
test eax, eax
jne 0x1002141b
cmp dword [0x1003c528], eax
jle 0x10021460
dec dword [0x1003c528]
cmp dword [0x1003c7d8], eax
jne 0x1002140a
call fcn.10025c7c
call fcn.10026b29
call fcn.100228df
call fcn.1002705f
jmp 0x10021471
cmp eax, 2
jne 0x10021464
push 0x8c
push 1
call fcn.10025e0a
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10021460
push esi
push dword [0x1003a2f4]
call dword [0x1003c54c]
test eax, eax
push esi
je 0x1002145a
call fcn.100228fc
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x10021471
call fcn.10022c9c
pop ecx
xor eax, eax
jmp 0x10021474
cmp eax, 3
jne 0x10021471
push 0
call fcn.10022ac7
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc
Function at 0x10023201
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x100233d5
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x1003cca0]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x100233d5
test cl, 0x48
je 0x1002326c
cmp byte [eax + 5], 0xa
je 0x1002326c
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100232be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x100232a6
call fcn.100235f6
mov dword [eax], 9
call fcn.100235ff
mov dword [eax], esi
jmp 0x100232b6
cmp eax, 0x6d
je 0x100233d5
push eax
call fcn.10023608
pop ecx
or eax, 0xffffffff
jmp 0x100233d7
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x100233d0
test eax, eax
je 0x100232e5
cmp byte [ebx], 0xa
jne 0x100232e5
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x100232ee
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x100233ca
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x100233ba
cmp al, 0xd
je 0x10023320
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x100233ac
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x1002333a
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x10023335
add dword [ebp + 0x10], 2
jmp 0x1002338e
mov dword [ebp + 0x10], eax
jmp 0x100233a8
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10023362
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100233a8
cmp dword [ebp - 0xc], 0
je 0x100233a8
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x10023383
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x1002338e
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x100233ab
cmp ebx, dword [ebp + 0xc]
jne 0x10023393
cmp byte [ebp - 1], 0xa
jne 0x10023393
mov byte [ebx], 0xa
jmp 0x100233ab
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10028dc6
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x100233ac
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x10023304
jmp 0x100233ca
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x100233ca
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x100233d7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002416d
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x1003a1d0]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x1002419e
xor eax, eax
jmp 0x10024327
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x1003cca0]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x100241da
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.10029475
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x100242b5
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x100242f3
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x1002423e
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x1002422f
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x1002420f
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1002427e
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x10024287
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x10024200
jmp 0x10024289
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x10024322
cmp dword [ebp - 0x6c], edi
je 0x100242f3
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x100242e8
call fcn.100235f6
mov dword [eax], 9
call fcn.100235ff
mov dword [eax], esi
jmp 0x1002431d
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100242dd
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x10024289
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x10024289
push dword [ebp - 0x6c]
call fcn.10023608
pop ecx
jmp 0x1002431d
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x1002430b
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x1002430b
xor eax, eax
jmp 0x10024325
call fcn.100235f6
mov dword [eax], 0x1c
call fcn.100235ff
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x10024325
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.1001fde5
add ebp, 0x3a0
leave
ret
Function at 0x1002572e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.10020760
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100257c9
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x1003c79c]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x100257c9
cmp eax, 1
je 0x100257ea
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100257c9
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x10025796
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x100257c5
xor eax, eax
inc eax
jmp 0x10025809
cmp edi, eax
jae 0x100257cd
xor eax, eax
jmp 0x10025809
cmp eax, esi
jae 0x100257d4
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x1003c79c]
jmp 0x100257ed
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10025ba8
Capabilities:
Terminate process

Disassembly:
push 8
push 0x10034fe8
call fcn.10021cb8
push 8
call fcn.100246ab
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x1003c7dc], esi
jne 0x10025bdc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x1003c7d8], esi
mov al, byte [ebp + 0x10]
mov byte [0x1003c7d4], al
cmp dword [ebp + 0xc], edi
jne 0x10025c26
cmp dword [0x1003cda8], edi
je 0x10025c16
mov eax, dword [0x1003cda4]
sub eax, 4
mov dword [0x1003cda4], eax
cmp eax, dword [0x1003cda8]
jb 0x10025c16
mov eax, dword [eax]
cmp eax, edi
je 0x10025bf7
call eax
jmp 0x10025bf7
push 0x1003a034
mov eax, 0x1003a02c
call fcn.10025b26
pop ecx
push 0x1003a040
mov eax, 0x1003a038
call fcn.10025b26
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x10025c57
cmp dword [ebp + 0x10], edi
jne 0x10025c65
mov dword [0x1003c7dc], esi
push dword [ebp + 8]
call fcn.10025ae4
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x10025c64
push 8
call fcn.100245f6
pop ecx
ret
call fcn.10021cf3
ret
Function at 0x100270de
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x1003a1d0]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x1003ab40]
je 0x10027113
inc eax
cmp eax, 0x13
jb 0x10027104
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x1003ab40]
jne 0x10027239
mov eax, dword [0x1003c534]
cmp eax, 1
je 0x10027211
cmp eax, edx
jne 0x10027143
cmp dword [0x1003c538], 1
je 0x10027211
cmp ecx, 0xfc
je 0x10027239
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10027179
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.10024460
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.10021670
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x100271ad
mov eax, edi
push eax
call fcn.10021670
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x10034a54
push edi
call fcn.1001fc90
add esp, 0x10
push edi
call fcn.10021670
push dword [esi + 0x1003ab44]
mov ebx, eax
call fcn.10021670
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.10020760
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.10024460
push edi
push ebx
call fcn.10024470
push 0x10034a50
push ebx
call fcn.10024470
push dword [esi + 0x1003ab44]
push ebx
call fcn.10024470
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.10027db1
add esp, 0x2c
jmp 0x10027239
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x1003ab44]
push dword [esi]
call fcn.10021670
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.1001fde5
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x10027db1
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x1003c8fc], ebx
push esi
push edi
jne 0x10027e31
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10027e6c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x1003c8fc], eax
je 0x10027e6c
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x1003c900], eax
call esi
cmp dword [0x1003c79c], 2
mov dword [0x1003c904], eax
jne 0x10027e31
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x1003c90c], eax
je 0x10027e31
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x1003c908], eax
mov eax, dword [0x1003c908]
test eax, eax
je 0x10027e76
call eax
test eax, eax
je 0x10027e5d
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x1003c90c]
test eax, eax
je 0x10027e5d
test byte [ebp - 8], 1
jne 0x10027e76
cmp dword [0x1003c7a8], 4
jb 0x10027e70
or byte [ebp + 0x12], 0x20
jmp 0x10027e95
xor eax, eax
jmp 0x10027ea5
or byte [ebp + 0x12], 4
jmp 0x10027e95
mov eax, dword [0x1003c900]
test eax, eax
je 0x10027e95
call eax
mov ebx, eax
test ebx, ebx
je 0x10027e95
mov eax, dword [0x1003c904]
test eax, eax
je 0x10027e95
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x1003c8fc]
pop edi
pop esi
pop ebx
leave
ret