joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2748d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc ebx, eax
xchg ecx, eax
test dword [eax], eax
add byte [eax], al
add byte [eax], ch
invalid
push esi
push edi
mov esi, ecx
xor ecx, ecx
lea edi, [ebp - 0x20]
mov dword [ebp - 0x24], ecx
stosd dword es:[edi], eax
lea edi, [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
stosd dword es:[edi], eax
lea edi, [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
stosd dword es:[edi], eax
mov dword [ebp - 0x64], ecx
lea edi, [ebp - 0x60]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x54], ecx
lea edi, [ebp - 0x50]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x44], ecx
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp dword [esi + 0x1c], ecx
je 0x1508b
push ebx
mov ecx, esi
call fcn.00014ca5
mov edi, dword [esi + 0x40]
mov ebx, dword [esi + 0x44]
sub edi, dword [esi + 0x38]
sub ebx, dword [esi + 0x3c]
push dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], ebx
call dword [0x771414e8]
adc al, 0x8a
dec ecx
cmp dword [eax - 0x3da2e7b8], ecx
or al, 0
lea ecx, [edx - 0x6f6f8a4e]
nop
nop
nop
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 0x14]
mov dword [esi + 0x1c], eax
mov al, byte [esi + 0x39]
mov byte [esp + 0xc], al
mov al, byte [ecx + 0x18]
mov byte [esi + 0x39], al
mov ebx, dword [ecx + 0xc]
push edi
mov edi, dword [ecx + 0x10]
mov al, byte [edi]
mov ecx, dword [ecx + 8]
cmp al, 0x11
je 0x13be8
jbe 0x7857
cmp al, 0x13
ja 0x16ff3
test ebx, ebx
je 0x277b6
movzx edx, word [esi + 0x3a]
movzx eax, dx
inc edx
lea eax, [eax*4 + str.RSContextUnmarshall2]
mov word [esi + 0x3a], dx
mov dword [ecx], eax
test ebx, ebx
je 0x27539
mov al, byte [edi + 1]
test al, 8
jne 0x14ce9
test al, 0x10
jne 0x57152
inc edi
inc edi
movsx eax, word [edi]
add edi, eax
mov al, byte [esi + 0x39]
mov byte [esp + 0xf], al
and al, 0xf2
mov byte [esi + 0x39], al
movzx eax, byte [edi]
mov ecx, dword [0x75b975e4]
push edi
push ebx
and eax, 0x3f
push esi
call dword [ecx + eax*4]
mov al, byte [esp + 0xf]
mov byte [esi + 0x39], al
mov al, byte [esp + 0x10]
mov byte [esi + 0x39], al
mov eax, dword [esp + 0x18]
pop edi
mov dword [esi + 0x1c], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
jmp 0x274f4
Function at 0x1001ce20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 4], ecx
push dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
add ecx, 0x134
call fcn.10020413
call fcn.1002e1dd
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
push 0xa
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.1001c913
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
leave
ret 8

Function at 0x1001ed4f
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005a7e4
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x10095054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [0x10096c98]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov ecx, dword [0x10097628]
cmp ecx, dword [eax + 4]
jle 0x1001edd5
push 0x10097628
call fcn.1003477b
pop ecx
cmp dword [0x10097628], 0xffffffff
jne 0x1001edd5
and dword [ebp - 4], 0
push 0x1008b0b0
mov ecx, 0x10097630
call fcn.1001a75b
push 0x1005b999
call fcn.10034d4b
pop ecx
or dword [ebp - 4], 0xffffffff
push 0x10097628
call fcn.10034731
pop ecx
mov ecx, dword [ebp + 8]
call fcn.10018a53
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x1001ee53
push 0xffffffffffffffff
push 0x10097630
mov ecx, dword [ebp + 8]
call fcn.1002029e
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x1001ee3d
push dword [ebp - 0x18]
push 0
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp + 8]
call fcn.10020263
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 1
push dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
call fcn.1001ed4f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.10018a7d
push 0
mov ecx, dword [ebp + 8]
call fcn.10018a53
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x2c], eax
jmp 0x1001ee78
mov eax, dword [ebp - 0x14]
and eax, 0x10
jne 0x1001ee6b
mov eax, dword [ebp - 0x14]
and eax, 0x400
jne 0x1001ee6b
and dword [ebp - 0x1c], 0
jmp 0x1001ee72
mov dword [ebp - 0x1c], 1
mov al, byte [ebp - 0x1c]
mov byte [ebp - 0xd], al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 4
Function at 0x1001f65f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x10095054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x38], ecx
call fcn.1001a942
mov word [ebp - 0x3e], ax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x3e]
push eax
call fcn.1001a94c
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x1001f6a1
lea eax, [ebp + 8]
push eax
call fcn.10021331
pop ecx
jmp 0x1001f831
mov ecx, dword [ebp - 0x38]
call fcn.100075f8
test eax, eax
je 0x1001f6e9
mov ecx, dword [ebp - 0x38]
call fcn.100075f8
mov esi, eax
mov ecx, dword [ebp - 0x38]
call fcn.10020ada
cmp esi, eax
jae 0x1001f6e9
lea eax, [ebp + 8]
push eax
call fcn.1001a972
pop ecx
mov word [ebp - 0x40], ax
mov ecx, dword [ebp - 0x38]
call fcn.1001a97d
mov cx, word [ebp - 0x40]
mov word [eax], cx
mov ax, word [ebp + 8]
jmp 0x1001f831
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x4c], 0
jne 0x1001f6fc
call fcn.1001a942
jmp 0x1001f831
mov ecx, dword [ebp - 0x38]
call fcn.1002070f
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x38], 0
jne 0x1001f754
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x4c]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 8]
push eax
call fcn.1001a972
pop ecx
mov word [ebp - 0x50], ax
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
call fcn.1001c9c0
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x1001f742
mov ax, word [ebp + 8]
mov word [ebp - 0x3a], ax
jmp 0x1001f74b
call fcn.1001a942
mov word [ebp - 0x3a], ax
mov ax, word [ebp - 0x3a]
jmp 0x1001f831
mov dword [ebp - 0x58], 0x20
lea eax, [ebp + 8]
push eax
call fcn.1001a972
pop ecx
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x38]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x54]
call fcn.1001c198
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x1001f7b0
cmp dword [ebp - 0x44], 1
je 0x1001f7b0
cmp dword [ebp - 0x44], 3
je 0x1001f7fc
jmp 0x1001f82c
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x48], eax
je 0x1001f7e0
mov eax, dword [ebp - 0x38]
push dword [eax + 0x4c]
push dword [ebp - 0x48]
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.1003f26b
add esp, 0x10
cmp dword [ebp - 0x48], eax
je 0x1001f7e0
call fcn.1001a942
jmp 0x1001f831
mov eax, dword [ebp - 0x38]
mov byte [eax + 0x3e], 1
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x34], eax
je 0x1001f7f5
mov ax, word [ebp + 8]
jmp 0x1001f831
call fcn.1001a942
jmp 0x1001f831
mov eax, dword [ebp - 0x38]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.1001c9c0
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x1001f81d
mov ax, word [ebp + 8]
mov word [ebp - 0x3c], ax
jmp 0x1001f826
call fcn.1001a942
mov word [ebp - 0x3c], ax
mov ax, word [ebp - 0x3c]
jmp 0x1001f831
call fcn.1001a942
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10034635
leave
ret 4
Function at 0x1002077e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x10095054]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x100207a5
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax + 0x3e]
test eax, eax
jne 0x100207ac
mov al, 1
jmp 0x10020893
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x48], eax
call fcn.1001a942
mov word [ebp - 0x44], ax
push dword [ebp - 0x44]
mov ecx, dword [ebp - 0x30]
call dword [ebp - 0x48]
mov word [ebp - 0x32], ax
call fcn.1001a942
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x32]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.1001a94c
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x100207f3
xor al, al
jmp 0x10020893
mov dword [ebp - 0x50], 0x20
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x30]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x4c]
call fcn.1001c1ca
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x10020835
cmp dword [ebp - 0x38], 1
je 0x1002083c
cmp dword [ebp - 0x38], 3
je 0x10020886
jmp 0x10020891
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x3e], 0
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x3c], eax
je 0x10020869
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x3c]
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.1003f26b
add esp, 0x10
cmp dword [ebp - 0x3c], eax
je 0x10020869
xor al, al
jmp 0x10020893
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax + 0x3e]
test eax, eax
jne 0x1002087d
mov dword [ebp - 0x40], 1
jmp 0x10020881
and dword [ebp - 0x40], 0
mov al, byte [ebp - 0x40]
jmp 0x10020893
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x3e], 0
mov al, 1
jmp 0x10020893
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10034635
leave
ret
Function at 0x100231dc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x10023204
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.10005fab
jmp 0x100232e0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 4]
call fcn.1000743e
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x10023295
jg 0x1002322c
cmp dword [ebp + 0xc], 0
jbe 0x10023295
cmp dword [ebp - 8], 0
jl 0x10023295
jg 0x1002323a
cmp dword [ebp - 0xc], 0
jbe 0x10023295
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jg 0x10023258
jl 0x1002324c
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0xc]
jae 0x10023258
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
push dword [ebp - 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.100075f8
push eax
call fcn.10008808
add esp, 0xc
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
sbb ecx, dword [ebp - 8]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], ecx
push dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
call fcn.100074d1
cmp dword [ebp + 0x10], 0
jl 0x100232d4
jg 0x100232a3
cmp dword [ebp + 0xc], 0
jbe 0x100232d4
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0
je 0x100232d4
mov eax, dword [ebp - 4]
push dword [eax + 0x4c]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.1003f26b
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
leave
ret 0xc
Function at 0x100232e4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10095054]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
jg 0x1002330e
jl 0x10023305
cmp dword [ebp + 0xc], 0
ja 0x1002330e
xor eax, eax
xor edx, edx
jmp 0x10023443
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x38], 0
je 0x1002332d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
call fcn.100060c2
jmp 0x10023443
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x10]
call fcn.10007502
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x10023398
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.1000a532
pop ecx
pop ecx
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
call fcn.10007609
push eax
push dword [ebp + 8]
call fcn.10008808
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
call fcn.100075ae
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x4c], 0
je 0x10023434
mov ecx, dword [ebp - 0x10]
call fcn.10023d36
mov dword [ebp - 0x2c], 0xfff
cmp dword [ebp - 8], 0xfff
jbe 0x10023406
mov eax, dword [ebp - 0x10]
push dword [eax + 0x4c]
push 0xfff
push 1
push dword [ebp + 8]
call fcn.1003fc89
add esp, 0x10
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x18], 0xfff
je 0x10023404
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x10023443
jmp 0x100233b4
cmp dword [ebp - 8], 0
jbe 0x10023434
mov eax, dword [ebp - 0x10]
push dword [eax + 0x4c]
push dword [ebp - 8]
push 1
push dword [ebp + 8]
call fcn.1003fc89
add esp, 0x10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10034635
leave
ret 0xc
Function at 0x10023885
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x10095054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x38], ecx
call fcn.10008735
mov dword [ebp - 0x50], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.10008779
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x100238c6
lea eax, [ebp + 8]
push eax
call fcn.1000873d
pop ecx
jmp 0x10023a47
mov ecx, dword [ebp - 0x38]
call fcn.100075f8
test eax, eax
je 0x1002390a
mov ecx, dword [ebp - 0x38]
call fcn.100075f8
mov esi, eax
mov ecx, dword [ebp - 0x38]
call fcn.10007566
cmp esi, eax
jae 0x1002390a
lea eax, [ebp + 8]
push eax
call fcn.100087a6
pop ecx
mov byte [ebp - 0x39], al
mov ecx, dword [ebp - 0x38]
call fcn.10007468
mov cl, byte [ebp - 0x39]
mov byte [eax], cl
mov eax, dword [ebp + 8]
jmp 0x10023a47
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x4c], 0
jne 0x1002391d
call fcn.10008735
jmp 0x10023a47
mov ecx, dword [ebp - 0x38]
call fcn.10023d36
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x38], 0
jne 0x10023970
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x4c]
mov dword [ebp - 0x54], eax
lea eax, [ebp + 8]
push eax
call fcn.100087a6
pop ecx
mov byte [ebp - 0x58], al
push dword [ebp - 0x54]
push dword [ebp - 0x58]
call fcn.10022e79
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10023960
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
jmp 0x10023968
call fcn.10008735
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
jmp 0x10023a47
mov dword [ebp - 0x60], 0x20
lea eax, [ebp + 8]
push eax
call fcn.100087a6
pop ecx
mov byte [ebp - 0x2c], al
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2b]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x38]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x5c]
call fcn.1001c198
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x100239cb
cmp dword [ebp - 0x40], 1
je 0x100239cb
cmp dword [ebp - 0x40], 3
je 0x10023a16
jmp 0x10023a42
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x44], eax
je 0x100239fb
mov eax, dword [ebp - 0x38]
push dword [eax + 0x4c]
push dword [ebp - 0x44]
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.1003f26b
add esp, 0x10
cmp dword [ebp - 0x44], eax
je 0x100239fb
call fcn.10008735
jmp 0x10023a47
mov eax, dword [ebp - 0x38]
mov byte [eax + 0x3d], 1
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x34], eax
je 0x10023a0f
mov eax, dword [ebp + 8]
jmp 0x10023a47
call fcn.10008735
jmp 0x10023a47
mov eax, dword [ebp - 0x38]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.10022e79
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10023a35
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
jmp 0x10023a3d
call fcn.10008735
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
jmp 0x10023a47
call fcn.10008735
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10034635
leave
ret 4
Function at 0x10023da5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x10095054]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x10023dcc
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax + 0x3d]
test eax, eax
jne 0x10023dd3
mov al, 1
jmp 0x10023eb7
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x44], eax
call fcn.10008735
mov dword [ebp - 0x40], eax
push dword [ebp - 0x40]
mov ecx, dword [ebp - 0x30]
call dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
call fcn.10008735
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.10008779
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10023e17
xor al, al
jmp 0x10023eb7
mov dword [ebp - 0x54], 0x20
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x30]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x50]
call fcn.1001c1ca
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x10023e59
cmp dword [ebp - 0x34], 1
je 0x10023e60
cmp dword [ebp - 0x34], 3
je 0x10023eaa
jmp 0x10023eb5
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x3d], 0
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x38], eax
je 0x10023e8d
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x38]
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.1003f26b
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x10023e8d
xor al, al
jmp 0x10023eb7
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax + 0x3d]
test eax, eax
jne 0x10023ea1
mov dword [ebp - 0x3c], 1
jmp 0x10023ea5
and dword [ebp - 0x3c], 0
mov al, byte [ebp - 0x3c]
jmp 0x10023eb7
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x3d], 0
mov al, 1
jmp 0x10023eb7
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10034635
leave
ret

Function at 0x10025308
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x10095054]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x238], 0
mov dword [ebp - 0x23c], 2
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
jne 0x1002534d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100253ca
push 0x22c
push 0
lea eax, [ebp - 0x230]
push eax
call fcn.10036720
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x234]
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x100253ac
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp + 8]
call fcn.100257c4
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x234]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10025384
jmp 0x100253b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x238], eax
push dword [ebp - 0x234]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10034635
leave
ret
Function at 0x100287b6
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
jmp 0x100287c7
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jae 0x100287ea
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
movzx eax, byte [eax]
xor eax, dword [ebp + 8]
mov dword [ebp + 8], eax
imul eax, dword [ebp + 8], 0x1000193
mov dword [ebp + 8], eax
jmp 0x100287c0
mov eax, dword [ebp + 8]
leave
ret
Function at 0x1002df8b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 0xc]
call fcn.100068fa
lea eax, [eax + eax + 2]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
call fcn.10018a53
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
call fcn.10018a53
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 1
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002dffe
push str.Cannot_write_string_value:_RegSetValueExW_failed.
push dword [ebp - 4]
lea ecx, [ebp - 0x2c]
call fcn.1002e002
push 0x1009373c
lea eax, [ebp - 0x2c]
push eax
call fcn.1003611d
leave
ret 8
Function at 0x10031de0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 8
push eax
push 0
push dword [ebp - 4]
push 0x10031edf
push 0
push 0
call fcn.10041a25
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
leave
ret