joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475920
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b0ea8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push ebx
push esi
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
call fcn.00475d20
mov esi, eax
lea edx, [esp + 0x48]
xor ebx, ebx
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], 0x503434
call fcn.0047ce79
mov ecx, dword [0x4bda6c]
mov al, byte [esi]
push ecx
push ebx
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x48], 1
mov byte [esp + 0x30], al
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call fcn.004730a0
mov esi, 0x4bdac4
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0xc]
mov byte [esp + 0x3c], 3
cmp eax, ebx
je 0x4759c7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4759be
cmp al, 0xff
je 0x4759be
dec al
mov byte [ecx], al
jmp 0x4759c7
push ecx
call fcn.0049de8b
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.00499c80
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3c], 0xffffffff
cmp eax, ebx
mov dword [esp + 0x18], esi
je 0x475a0d
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x475a04
cmp al, 0xff
je 0x475a04
dec al
mov byte [ecx], al
jmp 0x475a0d
push ecx
call fcn.0049de8b
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.0047cf00
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x494150
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4b21a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.0048911a
mov eax, dword [0x4c0c40]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.0048904c
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.00494bf0
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x4941f7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4941ee
cmp al, 0xff
je 0x4941ee
dec al
mov byte [ecx], al
jmp 0x4941f7
push ecx
call fcn.0049de8b
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x494228
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x49421f
cmp al, 0xff
je 0x49421f
dec al
mov byte [ecx], al
jmp 0x494228
push ecx
call fcn.0049de8b
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x4a052e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4a0566
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0049e57c
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0049e554
jmp 0x4a0572
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4a1da3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4a1de5
call fcn.004a82c4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4a1de5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4a1ddc
xor eax, eax
jmp 0x4a1ded
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004a1df3
pop edi
pop esi
pop ebx
ret 4

Function at 0x4a87f4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4a8822
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a8840
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004a875a
jmp 0x4a8840
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4a8840
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004a875a
test edi, edi
mov eax, edi
jne 0x4a882a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4ab065
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x4ab08d
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x4ab09e
push 2
call edi
test ax, ax
jge 0x4ab09e
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.0049fb63
cmp dword [esi + 0x30], ebx
jne 0x4ab178
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.0049fb63
cmp eax, dword [esp + 0x34]
jne 0x4ab178
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x4ab114
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x4ab159
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x4ab178
cmp eax, 0x205
je 0x4ab178
cmp eax, 0x201
je 0x4ab178
cmp eax, 0x204
je 0x4ab178
cmp eax, ebx
jne 0x4ab13f
cmp dword [esp + 0x1c], 0x1b
je 0x4ab178
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x5051c4]
jbe 0x4ab16e
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x4ab0d1
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x10023f5
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
mov ebx, 0x100a34c
je 0x100240d
mov ebx, eax
and byte [ebp - 1], 0
mov ecx, esi
call fcn.0100246c
test eax, eax
jl 0x1002466
push edi
push 4
mov edi, 0x100a358
push edi
push ebx
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x100d48e
lea eax, [esi + 0x10]
push eax
mov al, byte [ebp + 8]
neg al
sbb eax, eax
and eax, 0x10000000
push eax
push 0
push ebx
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x100d49a
cmp byte [ebp - 1], 0
jne 0x100d4be
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
add ebx, 8
mov byte [ebp - 1], 1
jmp 0x1002437
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x100d4ad
call esi
jmp 0x1002465
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x1002465
lea eax, [ebp + 0xb]
push eax
push dword [esi + 0x14]
lea ecx, [ebp - 0x14]
call fcn.01002c53
push edi
push dword [esi + 0x14]
call dword [sym.imp.msvcrt.dll_wcscpy]
mov eax, dword [ebp - 0x10]
test eax, eax
pop ecx
pop ecx
jne 0x100d4e5
mov eax, 0x100a34c
push eax
push dword [esi + 0x14]
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
push 1
lea ecx, [ebp - 0x14]
call fcn.0100132c
jmp 0x1002463

Function at 0x1002860
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
mov esi, dword [ebp + 8]
push edi
call ebx
mov dword [ebp + 8], eax
xor edi, edi
push edi
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, esi
jb 0x10028f1
cmp eax, 0x80
jb 0x100289a
lea ecx, [esi + 0x80]
cmp eax, ecx
jb 0x10028f1
push 1
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x10050e0
push 0x4ff
push dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov edi, eax
call ebx
cmp edi, esi
jb 0x10028ef
cmp edi, 0x80
jae 0x100c2e9
cmp edi, esi
jne 0x10028ef
cmp dword [ebp + 0x10], 0xffffffff
je 0x1002872
sub eax, dword [ebp + 8]
cmp dword [ebp + 0x10], eax
jb 0x10028f8
sub dword [ebp + 0x10], eax
jmp 0x1002872
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
mov eax, 0x102
jmp 0x10028f1
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1002877
lea ecx, [esi + 0x80]
cmp edi, ecx
jb 0x10028ef
jmp 0x10028d8
Function at 0x10052f4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
call fcn.01001396
push 0
push 1
mov ecx, ebx
call fcn.0100151e
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
push dword [ebp + 0x1c]
lea edi, [ebx + 0x20]
lea esi, [ebp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x18], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x30]
movsd dword es:[edi], dword [esi]
call fcn.0100142d
mov eax, dword [ebp + 8]
xor esi, esi
cmp eax, esi
jne 0x100c9be
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
and byte [ebx + 0x44], 0
and byte [ebx + 0x38], 0
push esi
push 1
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x3c], eax
je 0x100539a
push esi
push esi
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x40], eax
je 0x100539a
lea eax, [ebp - 4]
push eax
push esi
push ebx
push 0x1004b95
push esi
push esi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
cmp eax, esi
mov dword [ebx + 0x34], eax
je 0x100539a
mov byte [ebx + 0x38], 1
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
jmp 0x100c9c9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1005340
test eax, eax
jg 0x100c9d6
call esi
mov esi, eax
jmp 0x100538a
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x100538a

Function at 0x10058fe
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push 0x1c
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, eax
cmp esi, ebx
jl 0x100599b
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x100c239
lea eax, [ebp - 0x210]
push eax
call fcn.010059d2
cmp dword [ebp + 0xc], ebx
je 0x100598a
mov esi, dword [sym.imp.msvcrt.dll_wcsncat]
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x210]
push 0x100b944
push eax
call esi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push eax
mov word [ebp - 8], bx
call esi
add esp, 0x18
lea eax, [ebp - 0x210]
push eax
mov word [ebp - 8], bx
call fcn.010059d2
pop edi
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
call fcn.01001b8d
xor esi, esi
cmp dword [ebp - 4], ebx
je 0x10059ca
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0xc], ebx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x10059ca
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x10059ca
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
pop esi
pop ebx
leave
ret 8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x100c24e
call esi
mov esi, eax
jmp 0x100599b
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x100599b
Function at 0x1005a01
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, 0x10138aa
call fcn.010012e0
push ecx
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
lea ecx, [esi + 0xc]
mov dword [ebp - 0x14], esi
mov dword [esi + 8], edi
call fcn.01001b30
mov dword [ebp - 4], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x48], edi
push edi
push edi
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 8
call fcn.01005b28
mov dword [esi + 0x60], edi
lea eax, [ebp - 0xd]
push eax
push edi
lea eax, [ebp - 0xd]
push eax
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 0xa
call fcn.01005a7e
or word [esi + 0x24], 0xffff
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x44], 0x64
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1007ef4
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
je 0x1007f0f
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 3
push ebx
push dword [ebp + 8]
call edi
test eax, eax
je 0x100c5a5
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp byte [ebp + 0x10], 0
je 0x100c5f0
cmp eax, 0xb7
jne 0x100c5f0
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
cmp byte [ebp + 0x14], al
setne al
lea eax, [eax + eax + 2]
or eax, 1
push eax
push ebx
push dword [ebp + 8]
call edi
test eax, eax
jne 0x1007f25
call esi
test eax, eax
jg 0x100c5ec
call esi
jmp 0x1007f27
call esi
jmp 0x100c5f8
test eax, eax
jle 0x1007f27
and eax, 0xffff
or eax, 0x80070000
jmp 0x1007f27
Function at 0x100826c
Capabilities:
Create directory

Disassembly:
mov eax, 0x1013215
call fcn.010012e0
sub esp, 0x20
mov al, byte [ebp + 0xf]
push esi
xor esi, esi
mov byte [ebp - 0x1c], al
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
cmp byte [ebp + 0xc], 0
mov dword [ebp - 4], esi
je 0x100c263
mov ecx, dword [ebp + 8]
push 1
push 0xffffffffffffffff
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0xc], 0x5c
call fcn.01007b49
cmp eax, 0xffffffff
je 0x1008315
mov ecx, dword [ebp + 8]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
call fcn.01008330
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.01003c6f
and byte [ebp - 4], 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0100132c
mov eax, dword [ebp - 0x18]
cmp eax, esi
je 0x100c276
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
push esi
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call edi
cmp esi, 1
je 0x1008311
cmp eax, 0xb7
jne 0x100c280
xor esi, esi
pop edi
pop ebx
push 1
lea ecx, [ebp - 0x1c]
call fcn.0100132c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 8
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.01003c6f
jmp 0x10082e0
mov eax, 0x100a34c
jmp 0x10082eb
cmp eax, 3
je 0x100c29c
test eax, eax
jg 0x100c290
mov esi, eax
jmp 0x1008313
and eax, 0xffff
or eax, 0x80070000
jmp 0x100c289
push 1
lea eax, [ebp - 0x1c]
push eax
call fcn.0100826c
mov esi, eax
test esi, esi
jl 0x1008313
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x100c2bd
mov eax, 0x100a34c
push 0
push eax
call ebx
test eax, eax
jne 0x1008311
call edi
test eax, eax
jg 0x100c2d4
call edi
jmp 0x100c289
call edi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1008313

Function at 0x1008519
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 0
je 0x1008530
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100854f
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
jne 0x100c607
xor eax, eax
pop esi
pop ebp
ret 0xc
cmp eax, 3
je 0x100854f
cmp byte [ebp + 0x10], 0
je 0x100c649
push 4
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x100854f
call esi
test eax, eax
jg 0x100c638
call esi
jmp 0x1008551
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x1008551
test eax, eax
jle 0x1008551
jmp 0x100c63a
Function at 0x1008559
Capabilities:
Get common file path
Query environment variable
Set environment variable

Disassembly:
mov eax, 0x1013363
call fcn.010012e0
sub esp, 0x214
push ebx
xor ebx, ebx
cmp dword [0x10188e8], ebx
mov dword [esp + 8], ebx
jne 0x1008608
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push edi
mov edi, 0x101890c
push 1
push edi
call esi
test eax, eax
jne 0x100861d
cmp dword [0x10188e8], ebx
jne 0x1008602
push 0x10188d0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0xc
call fcn.01001b59
pop ecx
mov dword [esp + 0x14], eax
cmp eax, ebx
mov dword [esp + 0x228], ebx
je 0x1008629
lea ecx, [esp + 0xf]
push ecx
mov ecx, eax
call fcn.01009456
cmp eax, ebx
mov dword [0x10188cc], eax
je 0x100862d
push ebp
mov ebp, 0x103
push ebp
lea eax, [esp + 0x20]
push eax
mov ebx, 0x100bcb0
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x100c39e
mov dword [0x10188e8], 1
xor ebx, ebx
pop ebp
push ebx
push edi
call esi
pop edi
pop esi
mov ecx, dword [esp + 0x218]
mov eax, dword [esp + 8]
pop ebx
mov dword fs:[0], ecx
leave
ret
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1008589
xor eax, eax
jmp 0x10085cc
mov dword [esp + 0x10], 0x8007000e
jmp 0x1008602
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x10085f5
Function at 0x100868f
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x100bc90
call fcn.010028ff
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x100880c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100880c
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
jne 0x100c664
cmp dword [ecx + 0x74], 0xe
jbe 0x100880c
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1018928], 0xffffffff
or dword [0x1018250], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x101891c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1018918]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1018924], eax
call fcn.01008d65
cmp dword [0x10188fc], edi
je 0x100c689
call fcn.010091fa
push 0x100bc8c
push 0x100bc88
call sub.msvcrt.dll__initterm
mov eax, dword [0x1018914]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1018910]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x30], eax
push 0x100bc84
push 0x100bc68
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
je 0x100c69a
mov dword [ebp - 0x34], esi
cmp word [esi], 0x22
jne 0x1008814
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x10087b4
cmp ax, 0x22
jne 0x10087a1
cmp word [esi], 0x22
jne 0x10087bf
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x10087cd
cmp ax, 0x20
jbe 0x10087ba
mov dword [ebp - 0x4c], edi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x4c], 1
jne 0x100c6a5
push 0xa
pop eax
push eax
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], edi
jne 0x100c6b8
push esi
call dword [sym.imp.msvcrt.dll_exit]
mov dword [ebp - 0x1c], edi
jmp 0x10086e7
cmp word [esi], 0x20
jbe 0x10087bf
jmp 0x100c6ae
cmp eax, 0x20b
jne 0x100880c
cmp dword [ecx + 0x84], 0xe
jbe 0x100880c
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x10086e1
push fcn.01008d65
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
jmp 0x100873c
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x100c6f3
movzx eax, word [ebp - 0x48]
jmp 0x10087e7
add esi, ebx
mov dword [ebp - 0x34], esi
jmp 0x1008814
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x100c6ed
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01002938
ret

Function at 0x1008fd3
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0
mov esi, ecx
push esi
push 0x1009f59
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
test eax, eax
setne cl
mov dword [esi + 0x90], eax
pop esi
mov eax, ecx
pop ecx
ret
Function at 0x1009071
Capabilities:
Accept command line arguments

Disassembly:
inc esi
inc esi
jmp 0x1009035
inc esi
inc esi
jmp 0x10090c8
cmp dword [ebp - 0xc], ebx
jne 0x1008e4b
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov dword [esi], eax
shl eax, 2
push eax
call fcn.01001b59
cmp eax, ebx
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
je 0x100c0ef
xor eax, eax
cmp dword [esi], ebx
jle 0x1008e4b
mov edx, dword [ecx]
mov dword [edx + eax*4], ebx
inc eax
cmp eax, dword [esi]
jl 0x1008e41
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10090c2
xor esi, esi
pop edi
push dword [ebp - 4]
call sub.msvcrt.dll_free
pop ecx
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
mov edx, dword [ebp - 4]
inc esi
inc esi
jmp 0x100902d
cmp ax, di
je 0x1008e09
cmp byte [ebp + 0x14], 0
jne 0x100c0cf
mov word [edx], ax
inc edx
inc edx
inc esi
inc esi
xor eax, eax
mov ax, word [esi]
cmp ax, bx
jne 0x1009011
mov word [edx], bx
mov edi, dword [ebp + 0xc]
cmp dword [edi], ebx
je 0x1009059
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll__wcsdup]
cmp eax, ebx
pop ecx
je 0x100c0ef
mov ecx, dword [edi]
mov edx, dword [ebp - 8]
mov dword [ecx + edx*4], eax
inc dword [ebp - 8]
xor eax, eax
mov ax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
pop ecx
je 0x10090df
inc esi
inc esi
jmp 0x100905c
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 4], ebx
mov dword [eax], ebx
jne 0x100909e
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp eax, ebx
mov dword [ebp + 0x10], eax
je 0x100c0c7
push edi
push dword [ebp + 0x10]
call dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [eax + eax + 2]
push eax
call fcn.01001b59
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 4], eax
je 0x100c0ef
mov dword [ebp - 0xc], ebx
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], ebx
xor eax, eax
mov ax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
pop ecx
jne 0x1008e10
xor edi, edi
mov di, word [esi]
cmp di, bx
je 0x1008e17
cmp di, 0x22
je 0x100900a
cmp di, 0x27
je 0x100900a
mov ebx, dword [ebp - 4]
test di, di
je 0x1009121
push edi
call dword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
pop ecx
jne 0x1009121
mov word [ebx], di
inc ebx
inc ebx
inc esi
inc esi
xor edi, edi
mov di, word [esi]
jmp 0x1009102
and word [ebx], 0
xor ebx, ebx
jmp 0x1009038
xor esi, esi
inc esi
jmp 0x1008e5b
cmp ax, 0x5c
jne 0x1009024
lea ecx, [esi + 2]
cmp word [ecx], bx
je 0x1009024
mov esi, ecx
mov ax, word [esi]
jmp 0x1009024
push dword [ebp + 0xc]
mov esi, 0x8007000e
push dword [ebp + 8]
call fcn.010089c3
jmp 0x1008e5a