joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005a6f0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10093383
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x100ae210]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
mov eax, dword [0x100ae210]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov ebx, edx
xor edi, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], edi
call dword [eax + 8]
test al, al
je 0x1005a888
call fcn.100607cf
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
lea ecx, [esp + 0x24]
mov dword [esp + 0x248], edi
call fcn.1002821d
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.100580f9
mov byte [esp + 0x248], 1
cmp dword [esp + 0x24], edi
je 0x1005a799
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x24], edi
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [esi + 0x3c]
mov eax, dword [edi]
push 2
push 0xa
push dword [esp + 0x18]
mov ecx, edi
push dword [edi + 4]
call dword [eax + 8]
mov ebx, 0xffff
mov esi, 0x80070000
test eax, eax
jne 0x1005a7d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1005a7d7
and eax, ebx
or eax, esi
test eax, eax
js 0x1005a81f
mov eax, dword [edi]
push 0
push 1
push 0
push 0x10006b20
push dword [esp + 0x20]
mov ecx, edi
call dword [eax + 0xc]
test eax, eax
jne 0x1005a803
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1005a819
and eax, ebx
or eax, esi
jmp 0x1005a817
mov eax, dword [edi]
push 2
push 0xea60
mov ecx, edi
call dword [eax + 0x10]
test eax, eax
je 0x1005a7f3
xor eax, eax
test eax, eax
js 0x1005a81f
mov byte [edi + 8], 1
mov esi, eax
push 0x10012220
lea eax, [esp + 0x18]
push eax
call fcn.100580f9
push esi
push dword [esp + 0x1c]
lea edi, [esp + 0x1c]
mov byte [esp + 0x250], 2
call fcn.10061303
mov byte [esp + 0x248], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.1007924a
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.100791e7
mov edi, dword [esp + 0x1c]
add eax, 0x10
mov dword [edi], eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.1007924a
lea esi, [esp + 0x24]
call fcn.100281ed
mov eax, edi
jmp 0x1005a895
push 0x1001ab1c
push ebx
call fcn.100580f9
mov eax, ebx
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.1007b431
mov esp, ebp
pop ebp
ret

Function at 0x1005b568
Capabilities:
Get common file path

Disassembly:
push 0x214
mov eax, 0x10093335
call fcn.1008721d
and dword [ebp - 4], 0
and dword [ebp - 0x21c], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
mov dword [ebp - 0x220], esi
call fcn.1007eb10
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.100580f9
and dword [ebp - 4], 0
mov eax, esi
mov dword [ebp - 0x21c], 1
call fcn.10060035
mov eax, esi
call fcn.100872af
ret
Function at 0x1005b5e7
Capabilities:
Get common file path

Disassembly:
push 4
mov eax, 0x1008f9db
call fcn.100871aa
and dword [ebp - 0x10], 0
push 0x1000c5a8
lea eax, [ebp - 0x10]
push eax
call fcn.100580f9
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov edx, dword [eax - 8]
xor ecx, ecx
inc ecx
sub ecx, dword [eax - 4]
mov esi, 0x104
sub edx, esi
or ecx, edx
jge 0x1005b62d
mov eax, esi
lea ecx, [ebp - 0x10]
call fcn.10079066
mov eax, dword [ebp - 0x10]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
or eax, 0xffffffff
lea esi, [ebp - 0x10]
call fcn.10078e28
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.100580f9
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.1007924a
mov eax, dword [ebp + 8]
call fcn.10087296
ret 4
Function at 0x1005ea7d
Capabilities:
Get hostname

Disassembly:
push 0xc
mov eax, 0x1008ea52
call fcn.100871aa
mov eax, dword [0x100aee70]
mov ecx, 0x100aee70
call dword [eax + 0xc]
lea ecx, [eax + 0x10]
mov dword [ebp - 0x10], ecx
xor edx, edx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, 0x104
inc edx
mov dword [ebp - 0x14], eax
sub edx, dword [ecx - 4]
mov ecx, dword [ecx - 8]
sub ecx, eax
or ecx, edx
jge 0x1005eac0
lea ecx, [ebp - 0x10]
call fcn.10079066
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push 7
call dword [sym.imp.Secur32.dll_GetComputerObjectNameW]
test al, al
je 0x1005eb36
or eax, 0xffffffff
lea esi, [ebp - 0x10]
call fcn.10078e28
push 0x2f
xor ecx, ecx
call fcn.1005861e
cmp eax, 0xffffffff
je 0x1005eb11
mov ecx, eax
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.100588a8
mov edi, esi
mov byte [ebp - 4], 1
call fcn.10058274
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.1007924a
lea eax, [ebp - 0x10]
call fcn.100586bc
push 0x100135f0
xor ecx, ecx
lea esi, [ebp - 0x10]
call fcn.10058652
cmp eax, 0xffffffff
je 0x1005eb36
call fcn.10062961
test al, al
je 0x1005eb49
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.1007924a
mov al, bl
call fcn.10087296
ret
mov bl, 1
jmp 0x1005eb36
Function at 0x100600b1
Capabilities:
Get system information on windows

Disassembly:
push 0x50
mov eax, 0x10091101
call fcn.100871aa
mov esi, ecx
mov edi, edx
lea eax, [ebp + 8]
xor ebx, ebx
push eax
mov ecx, 0x10011ea8
mov dword [ebp - 4], ebx
call fcn.10058377
test eax, eax
je 0x1006020b
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], ebx
je 0x1006020b
lea eax, [ebp + 8]
push eax
mov ecx, 0x10013928
call fcn.10058377
test eax, eax
jne 0x100600fe
push 2
jmp 0x10060112
lea eax, [ebp + 8]
push eax
mov ecx, 0x1001393c
call fcn.10058377
test eax, eax
jne 0x10060118
push 3
pop esi
jmp 0x10060217
lea eax, [ebp + 8]
push eax
mov ecx, 0x1001395c
call fcn.10058377
test eax, eax
jne 0x1006017a
mov byte [edi + 0x11], 1
cmp byte [edi + 0x10], bl
jne 0x10060110
push 9
pop ecx
mov dword [ebp - 0x5c], 0x10018740
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.10024e01
test al, al
je 0x10060172
call dword [sym.imp.sqmapi.dll_SqmIsWindowsOptedIn]
mov esi, eax
neg esi
sbb esi, esi
neg esi
add esi, 2
jmp 0x10060217
xor esi, esi
inc esi
jmp 0x10060217
push 0x10013978
lea eax, [ebp - 0x14]
push eax
call fcn.100580f9
push 0x10005e9c
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 2
call fcn.100580f9
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.100283d2
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.1007924a
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.1007924a
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x28]
call fcn.1002845d
mov byte [ebp - 4], 7
mov eax, dword [eax]
mov edx, dword [esi]
push eax
push ebx
mov ecx, esi
call dword [edx + 4]
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.1007924a
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x34]
call fcn.1002a398
push 0x1009c1c8
lea eax, [ebp - 0x34]
push eax
call fcn.10081847
xor eax, eax
cmp byte [edi + 0x10], bl
setne al
lea esi, [eax + eax + 1]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.1007924a
mov eax, esi
call fcn.10087296
ret 4
Function at 0x100609bb
Capabilities:
Accept command line arguments

Disassembly:
push 0x30
mov eax, 0x1009316e
call fcn.100871aa
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call edi
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.10023ed7
and dword [ebp - 4], 0
call edi
push eax
lea eax, [ebp - 0x18]
mov esi, 0x10018730
push eax
mov dword [ebp - 0x1c], esi
call fcn.100580f9
push 0
mov ebx, 0x10013d38
push ebx
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 1
call fcn.10023a76
mov byte [ebp - 0x11], al
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
mov dword [ebp - 0x1c], esi
call fcn.1007924a
cmp byte [ebp - 0x11], 0
je 0x10060a9b
call edi
push eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x24], esi
call fcn.100580f9
push ebx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.10023cef
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
mov dword [ebp - 0x24], esi
call fcn.1007924a
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x3c]
lea eax, [ebp - 0x18]
push eax
push 0x1ee
call fcn.1002c58b
mov edi, eax
push 0x10013cf0
lea eax, [ebp + 8]
push eax
call fcn.100580f9
push edi
push esi
lea edi, [ebp + 8]
mov byte [ebp - 4], 5
call fcn.10061303
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.1007924a
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.1007924a
lea ecx, [ebp - 0x3c]
call fcn.10024209
call fcn.10087296
ret 4
Function at 0x100637ed
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
push ebx
push esi
mov esi, eax
mov ecx, esi
call fcn.10066b52
push esi
push dword [ebp + 8]
call fcn.10066bef
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
mov eax, dword [esi + 4]
xor ebx, ebx
mov dword [esp + 0xc], ecx
test eax, eax
jle 0x1006382f
mov edx, dword [esi]
cmp dword [edx], ecx
je 0x10063832
inc ebx
add edx, 4
cmp ebx, eax
jl 0x10063823
or ebx, 0xffffffff
cmp ebx, 0xffffffff
jne 0x10063840
lea ebx, [esp + 0xc]
call fcn.1005b0af
mov eax, dword [esi + 4]
xor edx, edx
mov ebx, 0x409
test eax, eax
jle 0x1006385c
mov ecx, dword [esi]
cmp dword [ecx], ebx
je 0x1006385f
inc edx
add ecx, 4
cmp edx, eax
jl 0x10063850
or edx, 0xffffffff
cmp edx, 0xffffffff
jne 0x10063871
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0xc]
call fcn.1005b0af
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1006387e
Capabilities:
Check if file exists

Disassembly:
push 0xc
mov eax, 0x10092f3a
call fcn.100871aa
lea eax, [ebp - 0x14]
push eax
call fcn.10025d87
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.100791e7
add eax, 0x10
mov dword [ebp - 0x10], eax
push edi
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.1002c210
mov byte [ebp - 4], 2
push dword [eax]
lea eax, [ebp - 0x10]
call fcn.10058c05
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.1007924a
push 0x10014918
lea eax, [ebp - 0x10]
call fcn.10058c05
mov ebx, dword [ebp - 0x10]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push ebx
call esi
test eax, eax
jne 0x10063922
push edi
push 0x10014940
push eax
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
call fcn.10023a0d
add esp, 0xc
lea eax, [ebx - 0x10]
call fcn.1007924a
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.1007924a
xor al, al
call fcn.10087296
ret 8
cmp byte [ebp + 0xc], 0
je 0x100639c3
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.100791e7
add eax, 0x10
mov dword [ebp + 0xc], eax
push edi
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 3
call fcn.1002c210
mov byte [ebp - 4], 4
push dword [eax]
lea eax, [ebp + 0xc]
call fcn.10058c05
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.1007924a
push 0x100094c8
lea eax, [ebp + 0xc]
call fcn.10058c05
mov ebx, dword [ebp + 0xc]
push ebx
call esi
test eax, eax
jne 0x100639bb
push edi
push 0x100149a0
push eax
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
call fcn.10023a0d
add esp, 0xc
lea eax, [ebx - 0x10]
call fcn.1007924a
xor bl, bl
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.1007924a
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.1007924a
mov al, bl
jmp 0x1006391a
lea eax, [ebx - 0x10]
call fcn.1007924a
mov bl, 1
jmp 0x1006399e
Function at 0x10064093
Capabilities:
Check if file exists

Disassembly:
push 0x14
mov eax, 0x10092e9a
call fcn.100871aa
and dword [ebp - 0x20], 0
push 0x10014ae8
lea eax, [ebp - 0x18]
push eax
call fcn.100580f9
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov esi, eax
mov eax, dword [0x100aee70]
mov ebx, 0x100aee70
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x18]
lea eax, [ebp - 0x20]
push esi
push 0x10014b0c
push eax
call fcn.10078ea6
mov eax, dword [0x100aee70]
add esp, 0x10
mov ecx, ebx
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x1c], edi
xor ecx, ecx
mov byte [ebp - 4], 2
mov eax, dword [edi - 8]
inc ecx
sub ecx, dword [edi - 4]
mov esi, 0x104
sub eax, esi
or eax, ecx
jge 0x10064120
mov eax, esi
lea ecx, [ebp - 0x1c]
call fcn.10079066
mov edi, dword [ebp - 0x1c]
push esi
push edi
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
or eax, 0xffffffff
lea esi, [ebp - 0x1c]
call fcn.10078e28
push edi
lea eax, [ebp - 0x10]
push eax
call fcn.100580f9
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.10058d2e
mov eax, dword [0x100aee70]
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x20]
push esi
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
call fcn.10058c46
mov ebx, dword [ebp - 0x14]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10064190
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.10058c46
mov ebx, dword [ebp - 0x14]
lea eax, [ebx - 0x10]
call fcn.100791e7
mov ecx, dword [ebp + 8]
add eax, 0x10
mov dword [ecx], eax
lea eax, [ebx - 0x10]
call fcn.1007924a
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.1007924a
lea eax, [edi - 0x10]
call fcn.1007924a
lea eax, [esi - 0x10]
call fcn.1007924a
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.1007924a
mov eax, dword [ebp + 8]
call fcn.10087296
ret 4

Function at 0x10066b52
Capabilities:
Accept command line arguments
Identify system language via api

Disassembly:
push 0x24
mov eax, 0x10095196
call fcn.100871aa
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10023ed7
lea eax, [ebp - 0x18]
xor edi, edi
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], edi
call fcn.10024532
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], edi
je 0x10066bd1
push eax
call fcn.1007be1c
pop ecx
mov dword [ebp - 0x14], eax
cmp eax, 0xfffffffd
jne 0x10066ba8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov dword [ebp - 0x14], eax
cmp eax, edi
je 0x10066bd1
mov ecx, dword [esi + 4]
cmp ecx, edi
jle 0x10066bc1
mov edx, dword [esi]
cmp dword [edx], eax
je 0x10066bc4
inc edi
add edx, 4
cmp edi, ecx
jl 0x10066bb5
or edi, 0xffffffff
cmp edi, 0xffffffff
jne 0x10066bd1
lea ebx, [ebp - 0x14]
call fcn.1005b0af
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.1007924a
lea ecx, [ebp - 0x30]
call fcn.10024209
call fcn.10087296
ret
Function at 0x10067166
Capabilities:
Read file on windows

Disassembly:
push 0x20
mov eax, 0x1008f2de
call fcn.100871aa
xor ebx, ebx
mov dword [ebp - 0x10], ebx
xor edi, edi
inc edi
mov dword [ebp - 4], edi
mov eax, dword [0x100aee70]
mov esi, 0x100aee70
mov ecx, esi
call dword [eax + 0xc]
mov ecx, dword [ebp + 8]
add eax, 0x10
mov dword [ecx], eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
push ebx
push 0x80
push 3
push edi
push SysReAllocStringLen
mov byte [ebp - 4], 2
push dword [ebp + 0xc]
lea edi, [ebp - 0x24]
call fcn.100280e5
cmp eax, ebx
jge 0x1006723b
mov eax, dword [0x100aee70]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0x10], eax
mov byte [ebp - 4], 3
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.100791e7
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
push esi
lea eax, [ebp + 0x10]
push 0x100152ac
push eax
mov byte [ebp - 4], 4
call fcn.10078ea6
add esp, 0xc
lea eax, [esi - 0x10]
mov byte [ebp - 4], 3
call fcn.1007924a
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.10028371
mov esi, 0x100187e8
mov dword [ebp - 0x2c], esi
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.1002a3dc
push 0x1009c2fc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], esi
call fcn.10081847
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
call fcn.10077b91
push ebx
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp + 0x10]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
jne 0x10067261
call fcn.10078cf4
mov eax, dword [ebp - 0x14]
call fcn.1005fe60
cmp dword [ebp - 0x24], ebx
je 0x10067277
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.1007924a
mov eax, esi
call fcn.10087296
ret 0xc
Function at 0x10068908
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x480
mov eax, dword [0x100ae210]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push edi
push 0x44
pop edi
push edi
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x47c]
push 0
push eax
call fcn.1007eb10
push dword [esi + 0xc]
mov dword [ebp - 0x47c], edi
push dword [ebp - 0x420]
xor eax, eax
lea edi, [ebp - 0x434]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10015560
stosd dword es:[edi], eax
lea eax, [ebp - 0x41c]
push 0x208
push eax
mov dword [ebp - 0x424], 0x80004005
call fcn.1007c171
add esp, 0x20
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x47c]
push eax
xor edi, edi
push edi
push edi
push 0x4000020
push 1
push edi
push edi
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10068a50
mov dword [ebp - 0x420], 1
mov eax, dword [ebx]
push 0x4e20
push dword [esi]
mov ecx, ebx
call dword [eax + 0x20]
test eax, eax
mov eax, dword [ebx]
mov ecx, ebx
jne 0x100689e7
push 1
push dword [esi + 4]
call dword [eax + 0x20]
test eax, eax
jne 0x10068a39
mov dword [ebp - 0x420], edi
mov dword [ebp - 0x424], edi
jmp 0x10068a39
push 0x4e20
push dword [esi + 8]
call dword [eax + 0x20]
cmp eax, 0x102
je 0x10068a50
cmp eax, 0x80
je 0x10068a47
mov eax, dword [ebx]
push 1
push dword [esi]
mov ecx, ebx
call dword [eax + 0x20]
test eax, eax
je 0x10068a1a
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x10068a2a
mov eax, dword [ebx]
push 1
push dword [esi + 4]
mov ecx, ebx
call dword [eax + 0x20]
test eax, eax
jne 0x10068a30
mov dword [ebp - 0x420], edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp - 0x420], edi
jne 0x100689b7
jmp 0x10068a50
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x430]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
push dword [ebp - 0x434]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x424]
xor ecx, ebp
pop edi
call fcn.1007b431
leave
ret 4
Function at 0x10069675
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10094f7b
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x100ae210]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.10023ed7
and dword [esp + 0x30], 0
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
call fcn.100244e6
mov eax, dword [eax]
mov esi, dword [eax - 0xc]
mov eax, dword [esp + 8]
add eax, 0xfffffff0
call fcn.1007924a
test esi, esi
je 0x100696f9
push 4
pop esi
lea ecx, [esp + 0xc]
call fcn.10024209
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0xc]
call fcn.1002429c
test al, al
je 0x1006970a
push 2
jmp 0x100696dc
push 0
push 0x10003c2c
lea eax, [esp + 0x18]
push eax
call fcn.10023a76
test al, al
je 0x10069723
push 3
jmp 0x100696dc
xor esi, esi
inc esi
jmp 0x100696dd

Function at 0x10069b32
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10099564
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x100ae210]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
and dword [esp + 0x18], 0
push ebx
lea eax, [esp + 0x18]
push eax
call fcn.1003505a
and dword [esp + 0x40], 0
push dword [esp + 0x14]
movzx eax, bx
push eax
push 0x10015790
push 2
call fcn.10023a0d
mov eax, dword [esp + 0x24]
add esp, 0x10
push esi
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
call fcn.100791e7
add eax, 0x10
mov dword [edi], eax
lea eax, [esp + 0x18]
push eax
call fcn.1002a8ec
mov byte [esp + 0x40], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.10023ed7
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], 2
call fcn.1002450c
mov byte [esp + 0x40], 3
mov eax, dword [esp + 0xc]
cmp dword [eax - 0xc], 0
push esi
je 0x10069c3a
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.100347ae
push esi
push ebx
lea eax, [esp + 0x20]
push eax
push dword [ebp + 8]
mov byte [esp + 0x50], 4
call fcn.100350eb
push dword [esp + 0x18]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
call fcn.1007924a
lea ecx, [esp + 0x1c]
call fcn.10024209
push dword [esp + 0x10]
call esi
jmp 0x10069c67
push ebx
lea eax, [esp + 0x18]
push eax
push dword [ebp + 8]
call fcn.100350eb
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
call fcn.1007924a
lea ecx, [esp + 0x1c]
call fcn.10024209
push dword [esp + 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.1007924a
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10069c8f
Capabilities:
Accept command line arguments

Disassembly:
push 0x2c
mov eax, 0x10094f53
call fcn.100871aa
mov esi, dword [ebp + 8]
and dword [ebp - 0x18], 0
xor ebx, ebx
mov edi, 0x100aee70
inc ebx
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10079180
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.10023ed7
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 2
call fcn.10024472
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
mov eax, dword [ebp - 0x14]
setne bl
add eax, 0xfffffff0
call fcn.1007924a
test bl, bl
je 0x10069dd3
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.10024472
mov byte [ebp - 4], 3
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.100580f9
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.100791e7
lea ebx, [eax + 0x10]
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.1007924a
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.1007924a
mov eax, dword [0x100aee70]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 8
call fcn.10025435
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
call fcn.100580f9
mov byte [ebp - 4], 9
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x10069daa
lea eax, [ebp - 0x1c]
push eax
call fcn.10025d87
mov edi, esi
mov byte [ebp - 4], 0xa
call fcn.10058274
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.1007924a
push dword [ebp - 0x10]
mov eax, esi
call fcn.10058c05
jmp 0x10069db4
lea eax, [ebp - 0x10]
mov edi, esi
call fcn.10058274
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.1007924a
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.1007924a
mov byte [ebp - 4], 2
lea eax, [ebx - 0x10]
jmp 0x10069df1
lea eax, [ebp - 0x20]
push eax
call fcn.10025d87
mov edi, esi
mov byte [ebp - 4], 0xb
call fcn.10058274
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.1007924a
push dword [ebp + 0xc]
mov eax, esi
call fcn.10058c05
lea ecx, [ebp - 0x38]
call fcn.10024209
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.1007924a
mov eax, esi
call fcn.10087296
ret 8