joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10069df0
Capabilities:
Get common file path
Get hostname

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009a506
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
mov byte [esp + 0x40], bl
mov ecx, 0x18
lea edi, [esp + 0x41]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x18], 0x64
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
xor edx, edx
mov dword [esp + 0x15], edx
mov dword [esp + 0x19], edx
mov dword [esp + 0x1d], edx
mov dword [esp + 0x21], edx
lea eax, [esp + 0x14]
mov word [esp + 0x25], dx
push 0x2e
push eax
mov byte [esp + 0x1c], bl
mov byte [esp + 0x2f], dl
call fcn.10075b6a
add esp, 8
cmp eax, ebx
je 0x10069e9d
inc eax
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10069e77
lea edi, [esp + 0x40]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x10069e85
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x40]
push ecx
push str.TMainForm
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
jne 0x10069ffc
mov byte [esp + 0x110], bl
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x111]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea edx, [esp + 0x114]
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
mov byte [esp + 0xa8], bl
mov ecx, 0x18
lea edi, [esp + 0xa9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [esp + 0xa8]
mov eax, str.f02uj3wrvs_3dclx_n_p_g__
call fcn.10069b10
call fcn.1008cdb1
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
lea eax, [esp + 0xa8]
push eax
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x14]
push 0x1009cb94
or dword [eax], edx
push edx
mov dword [esp + 0x234], ebx
call fcn.10002d50
add esp, 0x10
lea ecx, [esp + 0x28]
call fcn.10075088
mov esi, dword [esp + 0xc]
push ebx
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x22c], 1
call fcn.1007511b
test eax, eax
lea ecx, [esp + 0x28]
jne 0x10069fc2
call fcn.10074d99
lea ecx, [esp + 0x28]
mov byte [esp + 0x224], bl
call fcn.100750ac
lea eax, [esi - 0x10]
mov dword [esp + 0x224], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10069fab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
xor al, al
mov ecx, dword [esp + 0x21c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10074d99
lea ecx, [esp + 0x28]
mov byte [esp + 0x224], bl
call fcn.100750ac
lea eax, [esi - 0x10]
mov dword [esp + 0x224], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10069ffc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
mov al, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006a270
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009a546
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x190
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
mov byte [esp + 0x90], bl
mov ecx, 0x40
lea edi, [esp + 0x91]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
mov byte [esp + 0x28], bl
mov ecx, 0x18
lea edi, [esp + 0x29]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [esp + 0x28]
mov eax, str.f02uj3wrvs_3cf_3cn__wp_g__
call fcn.10069b10
call fcn.1008cdb1
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x94]
push ecx
lea edx, [esp + 0x14]
push 0x1009cb94
push edx
mov dword [esp + 0x1b4], ebx
call fcn.10002d50
add esp, 0x10
lea ecx, [esp + 0x10]
call fcn.10075088
mov esi, dword [esp + 0xc]
push ebx
push esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x1ac], 1
call fcn.1007511b
test eax, eax
lea ecx, [esp + 0x10]
jne 0x1006a397
call fcn.10074d99
lea ecx, [esp + 0x10]
mov byte [esp + 0x1a4], bl
call fcn.100750ac
lea eax, [esi - 0x10]
mov dword [esp + 0x1a4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1006a380
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
xor al, al
mov ecx, dword [esp + 0x19c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10074d99
lea ecx, [esp + 0x10]
mov byte [esp + 0x1a4], bl
call fcn.100750ac
lea eax, [esi - 0x10]
mov dword [esp + 0x1a4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1006a3d1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x19c]
pop edi
pop esi
mov al, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006a710
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009a596
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x628
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x100
lea edi, [esp + 0x230]
rep stosd dword es:[edi], eax
xor ebx, ebx
mov ecx, 0x7d
lea edi, [esp + 0x38]
mov dword [esp + 0xc], ebx
rep stosd dword es:[edi], eax
call fcn.1008cdb1
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
lea edx, [esp + 0x38]
mov eax, str.l:_3udl3r__x.rj__f:gujnmui_ri3wrj3_ufxr___prgdybd5u5gc25r__x_f_px_l_
mov dword [esp + 0x63c], ebx
call fcn.10069b10
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x3c]
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1006a8a0
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x234]
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push edx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [esp + 0xc]
push eax
jne 0x1006a89a
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x230]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1006a7e6
sub eax, edx
mov dword [esp + 0x34], eax
je 0x1006a8a0
lea eax, [esp + 0x230]
push eax
lea ecx, [esp + 0x14]
call fcn.10002fd0
lea ecx, [esp + 0x1c]
call fcn.10075088
mov esi, dword [esp + 0x10]
push ebx
push esi
lea ecx, [esp + 0x24]
mov byte [esp + 0x644], 1
call fcn.1007511b
test eax, eax
lea ecx, [esp + 0x1c]
jne 0x1006a849
call fcn.10074d99
lea ecx, [esp + 0x1c]
mov byte [esp + 0x63c], bl
call fcn.100750ac
jmp 0x1006a8a0
call fcn.10074d99
lea ecx, [esp + 0x1c]
mov byte [esp + 0x63c], bl
call fcn.100750ac
lea eax, [esi - 0x10]
mov dword [esp + 0x63c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1006a883
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov al, 1
mov ecx, dword [esp + 0x634]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi - 0x10]
mov dword [esp + 0x63c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1006a8c5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x634]
pop edi
pop esi
xor al, al
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006ac00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2230
call fcn.10076300
push esi
push edi
xor eax, eax
mov ecx, 0x800
lea edi, [esp + 0x238]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
test al, 0xfc
je 0x1006ada2
dec eax
cmp eax, 7
ja case.0x1006ac33.3
jmp dword [eax*4 + 0x1006ada8]
mov eax, dword [str.DEBUG]
mov ecx, dword [0x100a42d0]
jmp 0x1006ac89
mov edx, dword [str.INFO]
mov eax, dword [0x100a42c8]
mov dword [esp + 0x238], edx
mov dword [esp + 0x23c], eax
jmp case.0x1006ac33.3
mov ecx, dword [str.ERROR]
mov edx, dword [0x100a42c0]
mov dword [esp + 0x238], ecx
mov dword [esp + 0x23c], edx
jmp case.0x1006ac33.3
mov eax, dword [str.FATAL]
mov ecx, dword [0x100a42b8]
mov dword [esp + 0x238], eax
mov dword [esp + 0x23c], ecx
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
push edx
push eax
lea ecx, [esp + 0x247]
push 0x1ff9
push ecx
call fcn.10076f46
add esp, 0x10
push 0x104
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x134]
push str._sHintSock.log
push ecx
call fcn.10077098
call fcn.100794bf
lea edx, [esp + 0x14]
push edx
call fcn.10078e25
lea edi, [esp + 0x18]
add esp, 0x10
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1006acf2
mov ax, word [0x1009f530]
lea ecx, [esp + 0x11]
push ecx
mov word [edi], ax
call fcn.10078db5
lea edi, [esp + 0xc]
add esp, 4
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1006ad15
mov dx, word [0x100a42a0]
lea eax, [esp + 0x130]
push 0x100a429c
push eax
mov word [edi], dx
call fcn.10078bde
mov esi, eax
add esp, 8
test esi, esi
je 0x1006ada2
lea eax, [esp + 8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1006ad50
push esi
sub eax, edx
push eax
lea ecx, [esp + 0x10]
push 1
push ecx
call fcn.10078d69
lea eax, [esp + 0x248]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1006ad74
sub eax, edx
push esi
push eax
lea edx, [esp + 0x240]
push 1
push edx
call fcn.10078d69
push esi
push 0x100a28dc
call fcn.10078bf1
push esi
call fcn.10078924
add esp, 0x1c
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1006b940
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x1000
call fcn.10076300
mov eax, dword [esp + 0x1004]
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
push str.Panel1
push str.TPanel
push 0
push eax
call esi
push str.MainPanel
push str.TPanel
push 0
push eax
call esi
push 0
push str.TPanel
push 0
push eax
call esi
push str.EditPanel
push str.TPanel
push 0
push eax
call esi
push 0
push str.TRichEdit2
push 0
push eax
call esi
test eax, eax
pop esi
je 0x1006b9db
push 0x1000
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [esp]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1006b9c0
mov ecx, dword [esp + 0x1008]
sub eax, edx
push eax
lea edx, [esp + 4]
push edx
call fcn.100024d0
add esp, 0x1000
ret
Function at 0x1006f630
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009a9d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax]
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x50]
test esi, esi
mov dword [esp + 0x14], edi
je 0x1006f67e
test ebx, ebx
je 0x1006f670
mov ecx, dword [ebx]
push ebx
call dword [ecx + 4]
mov eax, dword [esi]
test eax, eax
je 0x1006f67c
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi], ebx
cmp dword [esi], 0
je 0x1006f799
push 0xffffffffffffffff
push str.ExtraProperty_Signature
call fcn.10042020
add esp, 8
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x1006f6a8
push 0x8007000e
call fcn.10001100
mov eax, dword [edi + 0x5c]
mov ecx, eax
mov dword [esp + 0x144], 0
mov word [esp + 0x20], 0x13
mov dword [esp + 0x28], ecx
mov ebx, dword [esp + 0x20]
mov eax, dword [esi]
mov edx, dword [eax]
sub esp, 0x10
mov edi, esp
mov dword [edi], ebx
mov ebx, dword [esp + 0x34]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x2c]
mov dword [edi + 8], ecx
mov ecx, dword [esp + 0x3c]
push ebx
push eax
mov byte [esp + 0x15c], 1
mov dword [edi + 0xc], ecx
call dword [edx + 0x88]
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 0
mov edx, dword [eax]
push eax
call dword [edx + 0x94]
mov esi, dword [esi]
mov edx, dword [esi]
lea eax, [esp + 0x18]
push eax
push esi
call dword [edx + 0x78]
test eax, eax
jl 0x1006f74c
mov ecx, dword [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
call fcn.100472d0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1006f74c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
xor eax, eax
mov byte [esp + 0x30], 0
mov ecx, 0x40
lea edi, [esp + 0x31]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x30]
push eax
push 0x104
push 0xd
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push ebx
mov dword [esp + 0x148], 0xffffffff
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edi, dword [esp + 0x14]
mov ecx, edi
call fcn.1006f2a0
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10071f50
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x114
mov edx, dword [esp + 0x118]
push ebp
push esi
mov ebp, ecx
mov eax, dword [ebp]
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
push edx
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x1007205a
lea ecx, [esp + 8]
call fcn.10071e40
mov esi, eax
test esi, esi
mov eax, dword [esp + 0x10]
mov dword [esp + 8], eax
jne 0x1007205e
push edi
lea ecx, [esp + 0x18]
push ecx
push esi
push esi
push esi
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x34]
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x10072014
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x10]
call fcn.10071f50
mov edi, eax
test edi, edi
jne 0x10072076
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push edi
push edi
push edi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push edi
push eax
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x10071fd6
mov eax, dword [esp + 0xc]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x1007202d
push eax
call edi
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x124]
mov edx, dword [ebp]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1007204c
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x114
ret 4
mov eax, dword [esp + 8]
test eax, eax
je 0x10072069
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
add esp, 0x114
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10072085
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x114
ret 4
Function at 0x10072530
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov ebp, ecx
xor edi, edi
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x10072542
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp]
push edi
push eax
push 7
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x10073200
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1009ac08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov esi, dword [esp + 0x24]
mov ebp, dword [edi + 8]
sub esp, 8
add esi, 0xfffffff0
mov dword [esp + 0x18], esp
mov ebx, esp
push esi
mov dword [esp + 0x28], 0
call fcn.10001a10
add eax, 0x10
add esp, 4
mov dword [ebx], eax
mov eax, dword [esp + 0x30]
push ebp
mov ecx, edi
mov dword [ebx + 4], eax
call fcn.10073160
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10073273
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov eax, ebp
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 8
Function at 0x100767e1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x100767fe
call fcn.1007a26e
mov dword [eax], 0x16
xor eax, eax
jmp 0x10076868
push esi
push 0x8c
push 1
call fcn.1007d3ab
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10076853
push esi
call fcn.1007b663
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x10076831
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x1007674c
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x10076867
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.100772cd
test ebx, ebx
pop ecx
je 0x10076865
push ebx
call fcn.1007a280
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1007733e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.10076300
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100773d9
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x100ea898]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x100773d9
cmp eax, 1
je 0x100773fa
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100773d9
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x100773a6
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x100773d5
xor eax, eax
inc eax
jmp 0x10077419
cmp edi, eax
jae 0x100773dd
xor eax, eax
jmp 0x10077419
cmp eax, esi
jae 0x100773e4
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x100ea898]
jmp 0x100773fd
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1007841d
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
xor ebx, ebx
test edi, edi
jne 0x10078439
call fcn.1007a26e
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x100784ab
push esi
push 0x8c
push 1
call fcn.1007d3ab
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10078491
push esi
call fcn.1007b663
mov eax, dword [esp + 0x1c]
pop ecx
push esi
push 4
push esi
push 0x1007838b
push dword [esp + 0x24]
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
mov dword [esi + 4], edi
je 0x10078489
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x100784a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.100772cd
test ebx, ebx
pop ecx
je 0x100784a3
push ebx
call fcn.1007a280
pop ecx
or eax, 0xffffffff
jmp 0x100784aa
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x100796df
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x100797cf
mov eax, 0x94
call fcn.10076300
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10079844
mov ecx, dword [esi + 0x10]
mov dword [0x100ea898], ecx
mov eax, dword [esi + 4]
mov dword [0x100ea8a4], eax
mov edx, dword [esi + 8]
mov dword [0x100ea8a8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x100ea89c], esi
je 0x1007974a
or esi, 0x8000
mov dword [0x100ea89c], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x100ea8a0], eax
call fcn.1007eb3f
test eax, eax
pop ecx
je 0x10079844
call fcn.1007b85d
test eax, eax
jne 0x10079777
call fcn.1007eb90
jmp 0x10079844
call fcn.10081b46
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x100ec2b0], eax
call fcn.10081a24
mov dword [0x100ea884], eax
call fcn.10081505
test eax, eax
jl 0x100797c8
call fcn.10081982
test eax, eax
jl 0x100797c3
call fcn.1008174f
test eax, eax
jl 0x100797c3
push 0
call fcn.1007ae1b
test eax, eax
pop ecx
jne 0x100797c3
inc dword [0x100ea880]
jmp 0x10079855
call fcn.10081703
call fcn.1007b646
jmp 0x1007976d
test eax, eax
jne 0x100797ff
cmp dword [0x100ea880], eax
jle 0x10079844
dec dword [0x100ea880]
cmp dword [0x100ea8d4], eax
jne 0x100797ee
call fcn.1007af59
call fcn.10081703
call fcn.1007b646
call fcn.1007eb90
jmp 0x10079855
cmp eax, 2
jne 0x10079848
push 0x8c
push 1
call fcn.1007d3ab
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10079844
push esi
push dword [0x100c0e40]
call dword [0x100ea8e8]
test eax, eax
push esi
je 0x1007983e
call fcn.1007b663
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x10079855
call fcn.100772cd
pop ecx
xor eax, eax
jmp 0x10079858
cmp eax, 3
jne 0x10079855
push 0
call fcn.1007b82e
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc
Function at 0x1007ae85
Capabilities:
Terminate process

Disassembly:
push 8
push 0x100a6c50
call fcn.10079e0c
push 8
call fcn.1007d72b
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x100ea8d8], esi
jne 0x1007aeb9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x100ea8d4], esi
mov al, byte [ebp + 0x10]
mov byte [0x100ea8d0], al
cmp dword [ebp + 0xc], edi
jne 0x1007af03
cmp dword [0x100ec2a8], edi
je 0x1007aef3
mov eax, dword [0x100ec2a4]
sub eax, 4
mov dword [0x100ec2a4], eax
cmp eax, dword [0x100ec2a8]
jb 0x1007aef3
mov eax, dword [eax]
cmp eax, edi
je 0x1007aed4
call eax
jmp 0x1007aed4
push 0x100b7158
mov eax, 0x100b7150
call fcn.1007ae03
pop ecx
push 0x100b7164
mov eax, 0x100b715c
call fcn.1007ae03
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x1007af34
cmp dword [ebp + 0x10], edi
jne 0x1007af42
mov dword [0x100ea8d8], esi
push dword [ebp + 8]
call fcn.1007adc1
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x1007af41
push 8
call fcn.1007d676
pop ecx
ret
call fcn.10079e47
ret

Function at 0x1007f74d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x1007f77b
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x1007f782
cmp ebx, dword [eax + 4]
jae 0x1007f782
xor eax, eax
jmp 0x1007f972
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x1007f793
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x1007f7a9
cmp ecx, edx
jae 0x1007f8ee
cmp dword [eax + 4], 0
je 0x1007f7b2
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x1007f79a
cmp dword [ebp + 8], 0
je 0x1007f7d4
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x1007f8ee
cmp eax, esi
jae 0x1007f8ee
sbb al, byte [ecx]
add byte [eax], al