joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011570
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [esp + 0x18]
xor eax, eax
push edi
mov edi, dword [esp + 0x24]
cmp esi, edi
sete al
mov dword [esp + 0x10], ecx
mov edx, ebx
mov dword [esp + 0x14], eax
mov eax, ebx
and eax, 7
je 0x100115a6
sub edx, eax
add edx, 8
mov dword [esp + 0x1c], edx
jmp 0x100115aa
mov dword [esp + 0x1c], ebx
xor ebp, ebp
test edx, edx
mov dword [esp + 0x24], ebp
ja 0x100115c8
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
add esp, 8
ret 0xc
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x14], 0
je 0x10011617
lea eax, [ebp + 7]
cmp eax, ebx
jae 0x100115ea
lea edx, [esi + 4]
push edx
mov eax, ecx
push esi
call fcn.100109f0
add esi, 8
jmp 0x100116b3
mov eax, edx
sub eax, ebx
test eax, eax
lea ecx, [esi + ebx]
jle 0x10011601
push eax
push 0
push ecx
call fcn.10041500
add esp, 0xc
lea eax, [esi + 4]
push eax
mov eax, dword [esp + 0x14]
push esi
call fcn.100109f0
add esi, 8
jmp 0x100116b3
lea edx, [ebp + 7]
cmp edx, ebx
jae 0x1001165b
movzx eax, byte [esi]
mov byte [edi], al
movzx edx, byte [esi + 1]
mov byte [edi + 1], dl
movzx eax, byte [esi + 2]
mov byte [edi + 2], al
movzx edx, byte [esi + 3]
mov byte [edi + 3], dl
movzx edx, byte [esi + 4]
lea eax, [edi + 4]
mov byte [eax], dl
movzx edx, byte [esi + 5]
mov byte [edi + 5], dl
movzx edx, byte [esi + 6]
mov byte [edi + 6], dl
movzx edx, byte [esi + 7]
push eax
mov byte [edi + 7], dl
mov eax, ecx
jmp 0x100116a7
mov eax, ebx
sub eax, ebp
xor edx, edx
test eax, eax
mov ecx, edi
jle 0x1001168c
mov ebp, eax
mov edx, eax
jmp 0x10011670
mov bl, byte [esi]
mov byte [ecx], bl
add ecx, 1
add esi, 1
sub ebp, 1
jne 0x10011670
cmp eax, 8
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
jge 0x1001169f
mov eax, 8
sub eax, edx
push eax
push 0
push ecx
call fcn.10041500
add esp, 0xc
mov eax, dword [esp + 0x10]
lea ecx, [edi + 4]
push ecx
push edi
call fcn.100109f0
add esi, 8
add edi, 8
add ebp, 8
cmp ebp, dword [esp + 0x1c]
mov dword [esp + 0x24], ebp
jb 0x100115c0
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x100117d0
Capabilities:
Encode data using base64

Disassembly:
push esi
mov esi, edx
test esi, esi
push edi
mov edi, eax
je 0x100118df
test edi, edi
jle 0x100118df
cmp edi, 3
jl 0x1001187d
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea eax, [edx*4]
sub eax, edx
neg eax
add edi, eax
push ebx
jmp 0x10011810
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + 0x10073ac8]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
shl eax, 4
shr ebx, 4
or eax, ebx
movzx eax, byte [eax + 0x10073ac8]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
add ecx, 1
and eax, 0xf
add eax, eax
add eax, eax
shr ebx, 6
or eax, ebx
movzx eax, byte [eax + 0x10073ac8]
add ecx, 1
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + 0x10073ac8]
add ecx, 1
mov byte [ecx], al
add ecx, 1
add esi, 3
sub edx, 1
jne 0x10011810
pop ebx
test edi, edi
jle 0x100118d7
movzx edx, byte [esi]
shr edx, 2
movzx eax, byte [edx + 0x10073ac8]
mov byte [ecx], al
mov al, byte [esi]
and al, 3
add ecx, 1
shl al, 4
cmp edi, 1
jle 0x100118a7
mov dl, byte [esi + 1]
shr dl, 4
or al, dl
movzx eax, al
mov dl, byte [eax + 0x10073ac8]
mov byte [ecx], dl
add ecx, 1
cmp edi, 2
jge 0x100118be
mov al, 0x3d
jmp 0x100118cc
movzx eax, byte [esi + 1]
and eax, 0xf
mov al, byte [eax*4 + 0x10073ac8]
mov byte [ecx], al
add ecx, 1
mov byte [ecx], 0x3d
add ecx, 1
pop edi
mov byte [ecx], 0
mov al, 1
pop esi
ret
pop edi
xor al, al
pop esi
ret
Function at 0x10016fe0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
jne 0x10017037
cmp byte [ebp + 0x2c], 0
jne 0x1001702e
mov byte [ebp + 0x2c], 1
mov dword [ebp + 0x30], 2
mov ebx, dword [str.Failed_to_open_file]
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10017010
sub eax, edx
lea edi, [ebp + 0x34]
mov esi, eax
call fcn.100149a0
or eax, 0xffffffff
mov dword [ebp + 0x40], eax
mov dword [ebp + 0x3c], eax
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x10017051
mov edi, edi
mov ecx, esi
mov eax, dword [ecx]
mov edx, dword [eax]
mov esi, dword [esi + 0x28]
push 1
call edx
cmp esi, edi
jne 0x10017040
push 2
or eax, 0xffffffff
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x1c], edi
push edi
push ebx
mov dword [ebp + 8], eax
mov dword [ebp + 4], eax
call fcn.10044553
push ebx
call fcn.10044132
push 0
push 0
push ebx
mov edi, eax
call fcn.10044553
add esp, 0x1c
test edi, edi
jg 0x100170ae
cmp byte [ebp + 0x2c], 0
jne 0x1001702e
mov byte [ebp + 0x2c], 1
mov dword [ebp + 0x30], 0xc
mov ebx, dword [str.Error_document_empty.]
mov eax, ebx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100170a0
jmp 0x10017019
lea eax, [edi + 1]
push eax
call fcn.10041593
push ebx
push 1
mov esi, eax
push edi
push esi
mov byte [esi], 0
call fcn.100439af
add esp, 0x14
cmp eax, 1
je 0x10017105
push esi
call fcn.10040f62
add esp, 4
cmp byte [ebp + 0x2c], 0
jne 0x1001702e
mov byte [ebp + 0x2c], 1
mov dword [ebp + 0x30], 2
mov ebx, dword [str.Failed_to_open_file]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100170f7
jmp 0x10017019
mov byte [esi + edi], 0
cmp byte [esi], 0
mov eax, esi
mov ecx, esi
je 0x10017136
mov dl, byte [eax]
cmp dl, 0xd
jne 0x10017129
mov byte [ecx], 0xa
add eax, 1
add ecx, 1
cmp byte [eax], 0xa
jne 0x10017131
jmp 0x1001712e
mov byte [ecx], dl
add ecx, 1
add eax, 1
cmp byte [eax], 0
jne 0x10017112
mov eax, dword [esp + 0x18]
push eax
mov byte [ecx], 0
mov edx, dword [ebp]
mov edx, dword [edx + 8]
push 0
push esi
mov ecx, ebp
call edx
push esi
call fcn.10040f62
add esp, 4
pop edi
xor eax, eax
cmp byte [ebp + 0x2c], al
pop esi
pop ebp
sete al
pop ebx
ret 8
Function at 0x10020670
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x1006db32
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1007d1f8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [edi], 0x10075098
mov dword [edi + 0x54], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 4]
push esi
mov dword [esp + 0x24], ebx
push edi
mov dword [esp + 0x1c], 1
call fcn.100214a0
mov dword [esp + 0x20], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
call fcn.10022240
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x10081254]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, dword [esp + 0x2c]
push eax
mov byte [esp + 0x24], 2
call fcn.10021940
test eax, eax
jne 0x10020771
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + edi + 8]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x28], ebx
jne 0x10020760
or eax, 4
and eax, 0x17
test dword [ecx + 0xc], eax
mov dword [ecx + 8], eax
je 0x10020771
push ebx
call fcn.1001e2c0
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x10022240
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x1006af8b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1007d1f8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1006853b
push 4
mov dword [esp + 0x20], 0
call fcn.10041593
mov edi, eax
add esp, 4
test edi, edi
je 0x100222c0
call fcn.10068141
mov dword [edi], eax
call fcn.10067f4b
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.10068331
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x100222b5
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.10068352
jmp 0x100222c2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x10027990
Capabilities:
Read data from internet
Receive data

Disassembly:
mov eax, dword [eax]
sub esp, 8
test eax, eax
push ebx
push edi
jne 0x100279a6
or eax, 0xffffffff
pop edi
pop ebx
add esp, 8
ret 4
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push ecx
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1002799b
mov edx, dword [esp + 0xc]
add dword [esi + 0xc], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
cmp edi, dword [esi + 4]
je 0x10027a3a
mov ecx, edi
sub ecx, dword [esi + 0x18]
cmp ecx, 0x3e8
jbe 0x10027a0c
mov ebx, dword [esi + 0xc]
mov eax, ebx
sub eax, dword [esi + 0x1c]
xor edx, edx
div ecx
test eax, eax
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
jge 0x10027a03
fadd qword [0x100754e0]
fstp qword [esi + 0x10]
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], ebx
mov eax, dword [esi + 0xc]
fild dword [esi + 0xc]
test eax, eax
jge 0x10027a1c
fadd qword [0x100754e0]
mov ecx, edi
sub ecx, dword [esi]
test ecx, ecx
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
jge 0x10027a32
fadd qword [0x100754e0]
fdivp st(1)
mov dword [esi + 4], edi
fstp qword [esi + 0x20]
mov eax, dword [esp + 0xc]
pop edi
pop ebx
add esp, 8
ret 4
Function at 0x10027a80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1006c113
mov eax, dword fs:[0]
push eax
push ecx
push ebx
mov eax, dword [0x1007d1f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
push 0xffffffffffffffff
lea ecx, [esi + 4]
mov dword [esi], 1
push ebx
lea eax, [esp + 0x24]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.10003960
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x4c], 0xf
mov dword [esi + 0x48], ebx
mov byte [esi + 0x38], bl
cmp dword [esp + 0x34], 0x10
mov dword [esi + 0x58], vtable.GameMgr::GMBuffer_unsigned_char_.0
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov byte [esi + 0x68], bl
jb 0x10027b08
mov ecx, dword [esp + 0x20]
push ecx
call fcn.10040f62
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x10
ret 0x1c

Function at 0x1002a0d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
mov ecx, 4
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
push ecx
push eax
lea edx, [esp + 0x10]
push edx
push 0
mov dword [eax], 0
mov eax, dword [esi]
push str.EnableLUA
push eax
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1002a112
mov dword [esi + 4], eax
mov al, bl
pop ebx
add esp, 8
ret
mov al, 1
pop ebx
add esp, 8
ret

Function at 0x1002a170
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x1006d348
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebp
push esi
push edi
mov eax, dword [0x1007d1f8]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x34]
mov edx, dword [ebx]
xor esi, esi
lea eax, [esp + 0x34]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push esi
push ebp
push edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x4c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, esi
je 0x1002a1c3
mov dword [ebx + 4], eax
jmp 0x1002a211
mov edi, dword [esp + 0x34]
lea esi, [esp + 0x14]
call fcn.1002a820
mov edi, dword [esp + 0x38]
mov dword [esp + 0x2c], 0
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x34]
push ecx
push esi
lea edx, [esp + 0x18]
push edx
push 0
mov dword [edi], eax
mov eax, dword [ebx]
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1002a228
mov dword [ebx + 4], eax
test esi, esi
je 0x1002a211
push esi
call fcn.10041096
add esp, 4
xor al, al
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x20
ret 8
mov ecx, dword [esp + 0x34]
push ecx
push edi
mov ecx, esi
call fcn.10027bb0
test al, al
je 0x1002a204
test esi, esi
je 0x1002a246
push esi
call fcn.10041096
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x20
ret 8
Function at 0x1002cc00
Capabilities:
Get disk information
Get disk size

Disassembly:
sub esp, 0x3c
mov eax, dword [0x1007d1f8]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
push ebx
push ebp
push esi
mov dword [0x1007fdb4], eax
mov eax, dword [esp + 0x5c]
mov dword [0x1007fdb0], ecx
push edi
mov ecx, 0x15
mov dword [0x1007fdb8], edx
mov dword [0x1007fdbc], eax
call fcn.1002cb20
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
xor ebx, ebx
push ebx
push ebx
mov dword [esp + 0x2c], eax
xor ebp, ebp
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
call edi
mov esi, eax
test esi, esi
je 0x1002cd91
lea ecx, [esi + 1]
push ecx
call fcn.1004109b
add esp, 4
push eax
push esi
mov dword [esp + 0x18], eax
call edi
test eax, eax
je 0x1002cd80
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
test edi, edi
jle 0x1002cd56
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x1002cd39
xor eax, eax
push eax
push eax
lea edx, [esp + 0x24]
push edx
push esi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov eax, dword [esp + 0x20]
cmp ebp, eax
ja 0x1002ccd9
mov ecx, dword [esp + 0x1c]
jb 0x1002ccd1
cmp ebx, ecx
jae 0x1002ccd9
mov ebx, ecx
mov ebp, eax
mov dword [esp + 0x18], esi
xor eax, eax
push 0x20
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov word [esp + 0x49], ax
mov byte [esp + 0x4b], al
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
push 0
push 0
push esi
mov byte [esp + 0x48], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x1002cd39
push str.NTFS
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1002cd39
mov dword [esp + 0x14], esi
lea esi, [esi + edi + 1]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
test edi, edi
jg 0x1002cc97
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x1002cd5e
mov edi, dword [esp + 0x18]
test edi, edi
je 0x1002cd80
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.SHLWAPI.dll_PathSkipRootA]
mov esi, eax
push esi
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
mov eax, esi
mov ecx, 0x15
call fcn.1002cb40
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1002cd91
push eax
call fcn.10040f62
add esp, 4
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10040be4
add esp, 0x3c
ret
Function at 0x1002cde0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
push edi
lea eax, [esp + 0x14]
xor ebp, ebp
push eax
push ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebp
jbe 0x1002cee9
lea ecx, [esi + esi]
push ecx
push 1
call fcn.10041b85
mov edi, eax
add esp, 8
cmp edi, ebp
je 0x1002cee9
mov edx, dword [esp + 0x14]
push edi
push esi
push edx
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
push ecx
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1002ced6
cmp esi, 0x400
mov eax, 0x400
jb 0x1002ce60
lea eax, [esi + 1]
push eax
call fcn.1004109b
mov edx, dword [esp + 0x2c]
mov esi, eax
mov eax, dword [esp + 0x20]
movzx ecx, word [eax + 2]
push edx
movzx edx, word [eax]
push ecx
push edx
push str.StringFileInfo_04x_04x_s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push esi
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1002cecd
cmp dword [esp + 0x10], ebp
jbe 0x1002cecd
push ebp
call fcn.10041096
mov edx, dword [esp + 0x14]
add edx, 1
push edx
call fcn.1004109b
mov ecx, dword [esp + 0x20]
add esp, 8
mov ebp, eax
mov eax, dword [esp + 0x10]
push eax
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push esi
call fcn.10041096
add esp, 4
push edi
call fcn.100419d9
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
mov eax, 0x100735cc
pop ebx
add esp, 0x10
ret
Function at 0x1002cf00
Capabilities:
Create process on windows
Terminate process

Disassembly:
sub esp, 0x160
mov eax, dword [0x1007d1f8]
xor eax, esp
mov dword [esp + 0x15c], eax
mov eax, dword [esp + 0x168]
mov ecx, dword [esp + 0x170]
mov edx, dword [esp + 0x16c]
mov dword [0x1007fdb4], eax
mov eax, dword [esp + 0x174]
mov dword [0x1007fdb0], ecx
push esi
lea ecx, [esp + 0x5c]
mov dword [0x1007fdb8], edx
mov dword [0x1007fdbc], eax
call fcn.1002ca90
call fcn.1002cb60
mov esi, eax
xor eax, eax
push 0x3c
push eax
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x28], eax
call fcn.10041500
add esp, 0xc
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x7c]
push ecx
push 0
mov word [esp + 0x70], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1002cfcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], eax
jmp 0x1002cffa
mov edx, dword [esp + 8]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1002cfed
mov ecx, dword [esp + 8]
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x1002cffa
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 4]
push eax
call fcn.1002cb90
mov ecx, dword [esp + 0x160]
pop esi
xor ecx, esp
call fcn.10040be4
add esp, 0x160
ret

Function at 0x1002d020
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x15c
mov eax, dword [0x1007d1f8]
xor eax, esp
mov dword [esp + 0x158], eax
mov eax, dword [esp + 0x164]
mov ecx, dword [esp + 0x16c]
mov edx, dword [esp + 0x168]
mov dword [0x1007fdb4], eax
mov eax, dword [esp + 0x170]
mov dword [0x1007fdb0], ecx
push esi
lea ecx, [esp + 0x58]
mov dword [0x1007fdb8], edx
mov dword [0x1007fdbc], eax
call fcn.1002ca90
xor esi, esi
push 0x3c
xor eax, eax
lea ecx, [esp + 0x20]
push esi
push ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x44
mov dword [esp + 0x24], esi
call fcn.10041500
add esp, 0xc
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x18]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x78]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1002d0c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call fcn.1002cb90
mov ecx, dword [esp + 0x15c]
pop esi
xor ecx, esp
call fcn.10040be4
add esp, 0x15c
ret
Function at 0x1002db60
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov dword [0x1007fdb4], eax
mov eax, dword [esp + 0x14]
sub esp, 0x1c
mov dword [0x1007fdb0], ecx
mov dword [0x1007fdb8], edx
mov dword [0x1007fdbc], eax
call fcn.10035ec0
cmp dword [eax + 0x14], 0
je 0x1002dc2f
cmp byte [eax + 0x1c], 0
push eax
je 0x1002dbe9
lea ecx, [esp + 4]
push ecx
call fcn.10007e80
add esp, 8
cmp dword [eax + 0x18], 0x10
jb 0x1002dbb7
mov eax, dword [eax + 4]
jmp 0x1002dbba
add eax, 4
push 3
push 0
push eax
push str.iexplore.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [esp + 0x18], 0x10
jb 0x1002dc2f
mov edx, dword [esp + 4]
push edx
call fcn.10040f62
add esp, 4
add esp, 0x1c
ret
lea eax, [esp + 4]
push eax
call fcn.10007e80
add esp, 8
cmp dword [eax + 0x18], 0x10
jb 0x1002dc01
mov eax, dword [eax + 4]
jmp 0x1002dc04
add eax, 4
push 6
push 0
push eax
push str.iexplore.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [esp + 0x18], 0x10
jb 0x1002dc2f
mov ecx, dword [esp + 4]
push ecx
call fcn.10040f62
add esp, 4
add esp, 0x1c
ret