joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416fbc
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [esp + 0x30]
mov eax, dword [0x47d074]
test eax, eax
je 0x417069
mov eax, dword [eax]
test eax, eax
js 0x41705f
mov eax, dword [0x47d074]
test eax, eax
je 0x417078
mov eax, dword [eax]
test eax, eax
je 0x417038
mov eax, dword [0x47d078]
test eax, eax
je 0x417053
mov esi, dword [eax]
call fcn.0041ff24
mov edi, eax
mov dword [esp], esi
call sub.KERNEL32.dll_TlsGetValue
push esi
mov esi, eax
mov dword [esp], edi
call sub.KERNEL32.dll_SetLastError
push edi
mov dword [esp + 0x1c], esi
lea esi, [esp + 0x1c]
mov edx, esi
mov eax, ebx
mov ecx, dword [ebx + 0xc]
test ecx, ecx
jne 0x417045
call fcn.00416750
cmp eax, 7
je 0x41704c
call sub.msvcrt.dll_abort
mov eax, dword [0x47d07c]
test eax, eax
je 0x417087
mov esi, dword [eax]
jmp 0x417016
call fcn.00416c0c
jmp 0x41702e
mov eax, esi
call fcn.004169f4
call fcn.00416808
mov dword [0x47d078], eax
jmp 0x416ff9
call fcn.00416938
jmp 0x416fdd
call fcn.00416870
mov dword [0x47d074], eax
jmp 0x416fd3
call fcn.00416870
mov dword [0x47d074], eax
jmp 0x416fea
call fcn.004167e4
mov dword [0x47d07c], eax
mov esi, dword [eax]
jmp 0x417016

Function at 0x417098
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4170b8
mov dword [esp], ebx
call fcn.00416d8c
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov eax, dword [0x47d074]
test eax, eax
je 0x417148
mov edi, dword [eax]
test edi, edi
js 0x417134
mov eax, dword [0x47d074]
test eax, eax
je 0x417158
mov esi, dword [eax]
test esi, esi
je 0x417124
mov eax, dword [0x47d078]
test eax, eax
je 0x417178
mov esi, dword [eax]
call fcn.0041ff24
mov edi, eax
mov dword [esp], esi
call sub.KERNEL32.dll_TlsGetValue
push edx
mov esi, eax
mov dword [esp], edi
call sub.KERNEL32.dll_SetLastError
push ecx
mov dword [esp + 0x1c], esi
lea edx, [esp + 0x1c]
mov eax, ebx
call fcn.00416c0c
cmp eax, 7
je 0x41713c
call sub.msvcrt.dll_abort
lea esi, [esi]
mov eax, dword [0x47d07c]
test eax, eax
je 0x417168
mov esi, dword [eax]
jmp 0x417108
call fcn.00416938
jmp 0x4170cb
lea eax, [esp + 0x1c]
call fcn.004169f4
lea esi, [esi]
call fcn.00416870
mov dword [0x47d074], eax
jmp 0x4170c5
call fcn.00416870
mov dword [0x47d074], eax
jmp 0x4170d8
call fcn.004167e4
mov dword [0x47d07c], eax
mov esi, dword [eax]
jmp 0x417108
call fcn.00416808
mov dword [0x47d078], eax
jmp 0x4170eb

Function at 0x417318
Capabilities:
Allocate thread local storage

Disassembly:
push esi
push ebx
push eax
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x417340
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
pop eax
pop ebx
pop esi
jmp fcn.00420000
pop eax
pop ebx
pop esi
jmp fcn.0041ff24
Function at 0x41736c
Capabilities:
Get thread local storage value

Disassembly:
push esi
sub esp, 0x28
call fcn.0041ff24
mov esi, eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
push ecx
mov dword [esp], esi
mov dword [esp + 0x1c], eax
call sub.KERNEL32.dll_SetLastError
push esi
mov eax, dword [esp + 0x1c]
add esp, 0x28
pop esi
ret

Function at 0x41739c
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
je 0x4173c0
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp fcn.0041ff24

Function at 0x41769c
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
xor eax, eax
mov ecx, 0xffffffff
mov edi, dword [ebp + 8]
repne scasb al, byte es:[edi]
mov edx, ecx
not edx
lea eax, [edx - 1]
mov dword [ebp - 0x20], eax
lea eax, [edx + 0xe]
mov dword [ebp - 0x24], eax
lea eax, [edx + 0x3f]
and eax, 0xfffffff0
call fcn.00417a3c
sub esp, eax
lea ebx, [esp + 0xc]
mov esi, str.gcc_shmem_tdm2
mov ecx, 0xe
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
mov byte [esp + 0x1a], 0x2d
lea eax, [esp + 0x1b]
mov edi, eax
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + edx + 0xf]
mov cl, 0x20
mov al, 0x61
mov edi, esi
rep stosb byte es:[edi], al
lea edi, [edx + 0x2f]
mov byte [esp + edi + 0xc], 0
mov edx, dword [ebp - 0x24]
mov byte [esp + edx + 0xc], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateMutexA
sub esp, 0xc
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], 0x2d
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
test eax, eax
je 0x41774c
int3
mov dword [esp], ebx
call sub.KERNEL32.dll_FindAtomA
push ecx
test ax, ax
jne 0x4177e4
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov esi, eax
mov edx, dword [ebp - 0x20]
add edx, 0x10
mov dword [ebp - 0x20], edx
mov eax, edx
add eax, ebx
mov ecx, 0x20
lea esi, [esi]
mov edx, esi
shr edx, cl
and edx, 1
je 0x41778c
mov byte [eax], 0x41
inc eax
dec ecx
jne 0x417780
mov dword [esp], ebx
call sub.KERNEL32.dll_AddAtomA
push edx
test ax, ax
je 0x4177e0
movzx eax, ax
mov edx, dword [ebp - 0x20]
mov dword [esp], edx
mov ecx, edi
mov edx, ebx
call fcn.00417628
mov ebx, eax
cmp eax, esi
je 0x4177fd
mov dword [esp], esi
call fcn.0041fdc8
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.KERNEL32.dll_ReleaseMutex
push eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push edx
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
int3
movzx eax, ax
mov edx, dword [ebp - 0x20]
add edx, 0x10
mov dword [esp], edx
mov ecx, edi
mov edx, ebx
call fcn.00417628
mov ebx, eax
jmp 0x4177be
xor eax, eax
mov edi, esi
mov ecx, dword [ebp + 0xc]
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4177be
mov dword [esp], esi
mov eax, dword [ebp + 0x10]
call eax
jmp 0x4177be
Function at 0x1000ef00
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push eax
push esi
push 1
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
sub eax, esi
add esp, 0x10
neg eax
sbb eax, eax
pop esi
ret

Function at 0x10013360
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x44
mov eax, dword [0x10069028]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
mov ebp, dword [esp + 0x50]
push esi
push edi
push 0x1003463c
call dword [sym.imp.MSVCR90.dll_getenv]
mov esi, eax
add esp, 4
test esi, esi
je 0x100133e3
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10013390
sub eax, edx
cmp eax, 0x40
jae 0x100133af
inc eax
push eax
lea eax, [esp + 0x14]
push esi
push eax
call sub.MSVCR90.dll_memcpy
mov esi, eax
jmp 0x100133cc
lea edi, [eax + 1]
push edi
mov ebx, esi
call dword [sym.imp.MSVCR90.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x100133cf
push edi
push ebx
push esi
call sub.MSVCR90.dll_memcpy
add esp, 0xc
push 1
push 0x10034638
push 0x1003463c
call fcn.100132a0
add esp, 0xc
mov edi, dword [sym.imp.MSVCR90.dll__tzset]
call edi
push ebp
call dword [sym.imp.MSVCR90.dll__mktime64]
add esp, 4
mov ebx, eax
mov ebp, edx
test esi, esi
je 0x10013423
push 1
push esi
push 0x1003463c
call fcn.100132a0
lea ecx, [esp + 0x1c]
add esp, 0xc
mov byte [esp + 0x10], 0
cmp esi, ecx
je 0x10013430
push esi
call dword [sym.imp.MSVCR90.dll_free]
jmp 0x1001342d
push 0x1003463c
call fcn.10013300
add esp, 4
call edi
mov ecx, dword [esp + 0x50]
pop edi
pop esi
mov edx, ebp
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.1002ea94
add esp, 0x44
ret
Function at 0x1002ea94
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10069028]
jne 0x1002ea9e
repz ret
jmp fcn.1002ef23
Function at 0x10019997
Capabilities:
Get file attributes
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100199c2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100199c0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x100199ca
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esp, ebp
pop ebp
ret

Function at 0x1001bfbd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001bfd4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x1001bfee
push 0xfec
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret
Function at 0x1001c041
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1001c06a
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001c065
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x1001c1b8
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x1001c0bc
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0xffffffe6
jge 0x1001c1b8
mov dword [ebp - 8], 0x7319
mov dword [ebp - 0x10], 7
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 8]
cmp eax, dword [ebp - 8]
jle 0x1001c0eb
mov dword [ebp - 0x14], 1
jmp 0x1001c0ef
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x50]
cmp eax, dword [ecx]
jne 0x1001c105
mov dword [ebp - 0x18], 1
jmp 0x1001c109
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x18], eax
jge 0x1001c11a
mov dword [ebp - 0x1c], 1
jmp 0x1001c11e
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x34]
sub eax, dword [ecx]
cmp eax, dword [ebp - 8]
jle 0x1001c13c
mov dword [ebp - 0x20], 1
jmp 0x1001c140
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp dword [ebp - 0x20], eax
jl 0x1001c153
mov dword [ebp - 0x24], 1
jmp 0x1001c157
and dword [ebp - 0x24], 0
cmp dword [ebp - 0x24], 0x50e16ffa
jne 0x1001c169
mov dword [ebp - 0x28], 1
jmp 0x1001c16d
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x28], eax
jg 0x1001c17e
mov dword [ebp - 0x2c], 1
jmp 0x1001c182
and dword [ebp - 0x2c], 0
cmp dword [ebp - 0x2c], 0
jg 0x1001c191
mov dword [ebp - 0x30], 1
jmp 0x1001c195
and dword [ebp - 0x30], 0
cmp dword [ebp - 0x30], 1
ja 0x1001c1a4
mov dword [ebp - 0x38], 1
jmp 0x1001c1a8
and dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
add eax, dword [ebp - 0x38]
mov dword [ebp - 0x10], eax
jmp 0x1001c0b1
mov esp, ebp
pop ebp
ret
Function at 0x100266d2
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100266ec
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x10026742
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
push dword [eax]
push 0x4701
push 0
push 0x32e8
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
push dword [eax]
mov eax, dword [ebp - 0x20]
push dword [eax]
call fcn.1002a647
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x100268f8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10026915
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x10026a64
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0xffffffef
jmp 0x10026967
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jg 0x10026a64
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 4], 0xfffffffc
jmp 0x10026991
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffe9
jle 0x10026a5f
mov dword [ebp - 0xc], 8
mov dword [ebp - 0x44], 0x512a30a
mov eax, dword [ebp - 4]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
jg 0x100269cf
mov dword [ebp - 0x18], 1
jmp 0x100269d3
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
jne 0x100269ec
mov eax, 0x9c8ddac0
test eax, eax
je 0x100269fe
mov eax, 0x2401dbda
test eax, eax
je 0x100269fe
mov dword [ebp - 0x40], 1
jmp 0x10026a02
and dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x18], 0x5bd5
jle 0x10026a1a
mov dword [ebp - 0x1c], 1
jmp 0x10026a1e
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
cmp eax, dword [ecx]
jg 0x10026a34
mov dword [ebp - 0x24], 1
jmp 0x10026a38
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x28]
mov dword [eax], ecx
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
mov dword [eax], ecx
cmp dword [ebp - 4], 0
je 0x10026a5a
jmp 0x1002698a
jmp 0x1002698a
jmp 0x1002695c
mov esp, ebp
pop ebp
ret
Function at 0x1002a78f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002a7b5
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002a7b3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x1002a7df
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
movzx eax, word [eax]
and eax, 0xfff
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret

Function at 0x1002af5a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002afa1
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
add ecx, dword [eax]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x1002afd1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1002afd1
push 0xfec
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret
Function at 0x1002ea71
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002ea95
xor eax, eax
jmp 0x1002ebe8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002eab3
xor eax, eax
jmp 0x1002ebe8
lea eax, [ebp - 8]
push eax
push 0x60fa
push 1
lea eax, [ebp - 0xc]
push eax
call fcn.1002e8ca
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x1002ead7
xor eax, eax
jmp 0x1002ebe8
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xcb2
call fcn.1002e91d
add esp, 0x1c
push dword [ebp - 8]
push 0x1cab
push dword [ebp - 4]
push 0x3748
push 0x1409
push 0x6ba5
push 0x2790
push 0
push dword [ebp + 8]
call fcn.1002d3ba
add esp, 0x24
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
push 1
lea eax, [ebp - 8]
push eax
push 0x693c
call fcn.1002e9ab
add esp, 0x14
push 0x431b
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
push eax
call fcn.1002ea0c
add esp, 0x10
push dword [ebp - 4]
call fcn.1002d120
pop ecx
test eax, eax
jne 0x1002eb69
xor eax, eax
jmp 0x1002ebe8
push dword [ebp - 4]
push 0x6ff0
push 0x1b4c
push 0
call fcn.1002827c
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002ebd0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
jne 0x1002eb9f
xor eax, eax
jmp 0x1002ebe8
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002ebb8
xor eax, eax
jmp 0x1002ebe8
lea eax, [ebp - 4]
push eax
push 1
push 0x128d
push 0x4ead
call fcn.1002ea0c
add esp, 0x10
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002ebe1
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x1002ebe5
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x1003ee6f
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x1003eef3
push ebx
push dword [esi]
xor ebx, ebx
push ebx
push dword [esi + 4]
call fcn.100243a3
push dword [esi + 4]
call fcn.10061092
mov dword [esi + 4], ebx
add esp, 0x10
mov dword [ebp - 8], 0x7c7ce53d
mov dword [ebp - 8], ebx
jmp 0x1003eeb3
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xc], 0xa5d6
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jl 0x1003eea5
mov dword [ebp - 8], ebx
jmp 0x1003eedb
mov ecx, dword [ebp + eax*4 - 0xc]
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xc], ecx
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1003eed8
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jle 0x1003eebe
xor ecx, ecx
mov dword [esi], ebx
cmp eax, 0x5534
pop ebx
setle cl
mov dword [ebp - 8], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004200e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10042037
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10042032
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x1004217a
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
imul eax, dword [ecx]
mov ecx, dword [ebp - 8]
cmp eax, dword [ecx]
jle 0x100420a6
mov dword [ebp - 0x10], 1
jmp 0x100420aa
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x54]
cmp ecx, dword [eax]
jne 0x100420c2
mov dword [ebp - 0x14], 1
jmp 0x100420c6
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x14], eax
jge 0x100420d9
mov dword [ebp - 0x18], 1
jmp 0x100420dd
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x30]
sub eax, dword [ecx]
mov ecx, dword [ebp - 8]
cmp eax, dword [ecx]
jle 0x100420ff
mov dword [ebp - 0x1c], 1
jmp 0x10042103
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
cmp dword [ebp - 0x1c], eax
jl 0x10042116
mov dword [ebp - 0x20], 1
jmp 0x1004211a
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], 0x50e16ffa
jne 0x1004212c
mov dword [ebp - 0x24], 1
jmp 0x10042130
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x24], eax
jg 0x10042143
mov dword [ebp - 0x28], 1
jmp 0x10042147
and dword [ebp - 0x28], 0
cmp dword [ebp - 0x28], 0
jg 0x10042156
mov dword [ebp - 0x2c], 1
jmp 0x1004215a
and dword [ebp - 0x2c], 0
cmp dword [ebp - 0x2c], 1
ja 0x10042169
mov dword [ebp - 0x34], 1
jmp 0x1004216d
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
add eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x100421b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10042229
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
and dword [ebp - 4], 0
jmp 0x100421fb
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax]
jge 0x10042227
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
and dword [ecx + eax], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, 4
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x100421f4
jmp 0x10042243
push 0xfec
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret