joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464140
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 4]
mov dword [esi], vtable.CMD5Checksum.0
push eax
call fcn.0048b4c0
add esp, 0xc
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov eax, esi
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
pop esi
ret

Function at 0x465060
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x4ff684]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ecx + 8]
test edi, edi
je 0x4650e7
test esi, esi
je 0x4650e7
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.0048b4c0
add esp, 0xc
mov dword [ebp - 0x88], 0x7f
lea eax, [ebp - 0x88]
push 0
push eax
lea eax, [ebp - 0x84]
push eax
push 0
push 5
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x4650e7
lea eax, [ebp - 0x84]
push eax
call fcn.00497471
add esp, 4
mov dword [esi], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00488f07
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.00488f07
mov esp, ebp
pop ebp
ret 4

Function at 0x465100
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4ff684]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ecx + 8]
test esi, esi
je 0x465178
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.0048b4c0
add esp, 0xc
mov dword [ebp - 0x108], 0xff
lea eax, [ebp - 0x108]
push 0
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0x13
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x465178
lea eax, [ebp - 0x104]
push eax
call fcn.00497471
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00488f07
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00488f07
mov esp, ebp
pop ebp
ret
Function at 0x4a5d1c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a59cd

Function at 0x4a5d27
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a5b57

Function at 0x4a7c54
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a7bd6

Function at 0x4b5920
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x4b5945
xor ecx, ecx
cmp cx, word [eax]
je 0x4b5945
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4b5945
test al, 0x10
je 0x4b5945
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x4b6240
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c0a70
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4ff684]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
call fcn.0041f940
mov ecx, eax
test ecx, ecx
je 0x4b6399
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor edi, edi
mov dword [ebp - 4], 1
nop word [eax + eax]
lea edx, [edi + 1]
test edx, edx
js 0x4b638f
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x4b62c8
push edx
lea ecx, [ebp - 0x10]
call fcn.0043bef0
mov esi, dword [ebp - 0x10]
cmp dword [esi - 4], 1
jle 0x4b62dc
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.0043c210
mov esi, dword [ebp - 0x10]
push esi
push dword [esi - 8]
call ebx
mov edi, eax
test edi, edi
je 0x4b6329
push dword [esi - 8]
push esi
call fcn.0048f713
add esp, 8
test eax, eax
js 0x4b638f
cmp eax, dword [esi - 8]
jg 0x4b638f
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp edi, dword [esi - 0xc]
ja 0x4b62a0
add esi, 0xfffffff0
push esi
call fcn.0043be70
mov edi, dword [ebp + 8]
add esp, 4
add eax, 0x10
mov dword [edi], eax
jmp 0x4b6366
call fcn.0041f940
mov ecx, eax
test ecx, ecx
je 0x4b63a3
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
push 0x4ebcc8
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.0043acf0
test al, al
jne 0x4b6363
push 0
push 0x4ebcc8
mov ecx, edi
call fcn.0043bf60
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4b637b
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.0041e2d0
push 0x80004005
call fcn.0041e2d0
push 0x80004005
call fcn.0041e2d0
int3

Function at 0x4b6e30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
lea ecx, [ebp + 8]
mov dword [ebp - 4], esi
call fcn.004b3690
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
push ebx
push dword [edi]
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp esi, 0xea
jne 0x4b6ea1
push dword [edi]
call fcn.004892ec
mov dword [edi], 0
push 0x4de2c2
push dword [ebx]
call fcn.004897ca
add esp, 0xc
mov dword [edi], eax
push ebx
push eax
push dword [ebp + 0x10]
mov eax, dword [ebp - 4]
push 0
push dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov edx, dword [ebp + 8]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b6ebc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4b6ed0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c0b60
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4ff684]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4b701a
mov ebx, dword [ebp + 0x14]
cmp ebx, 1
jb 0x4b701a
xor esi, esi
mov dword [ebp - 0x10], 0
mov dword [ebp + 0x14], esi
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], esi
cmp ecx, 1
jne 0x4b6f6f
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
mov ecx, edx
call fcn.004b6840
mov ebx, eax
test ebx, ebx
jne 0x4b6f8b
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x10]
mov dword [ebp + 0x10], esi
lea eax, [ebx + 0x20]
push eax
mov dword [ebp - 0x10], eax
call fcn.004892e3
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 1
test edi, edi
jne 0x4b6fad
lea ebx, [eax + 8]
jmp 0x4b6ff2
cmp ecx, 7
jne 0x4b6f4b
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
mov ecx, edx
call fcn.004b6680
mov ebx, eax
test ebx, ebx
je 0x4b6f42
mov esi, dword [ebp + 0x14]
push esi
call fcn.004892ec
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 0x14]
lea eax, [ebx + 0x20]
push eax
push edi
push dword [ebp + 0xc]
push ebx
push dword [ebp + 0x10]
call fcn.004b6a50
mov ebx, eax
test ebx, ebx
jne 0x4b6ff2
push dword [ebp + 8]
lea ecx, [ebp + 0x10]
call fcn.004b3690
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
push edi
push 3
push ebx
push dword [ebp + 0x10]
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp + 0x10]
mov ebx, eax
call fcn.004b3920
push edi
call fcn.004892ec
add esp, 4
push esi
call fcn.004892ec
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x57
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4b7380
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret
Function at 0x429f60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1a000]
push edi
jmp 0x429f7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x429f81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x429f70
mov eax, 1
add ebx, ebx
jne 0x429f93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x429f88
jne 0x429fa4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x429f88
xor ecx, ecx
sub eax, 3
jb 0x429fb8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42a02a
mov ebp, eax
add ebx, ebx
jne 0x429fc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x429fd0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x429ff4
inc ecx
add ebx, ebx
jne 0x429fe0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x429fd5
jne 0x429ff1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x429fd5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42a014
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42a005
jmp 0x429f76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42a014
add edi, ecx
jmp 0x429f76
pop esi
mov edi, esi
mov ecx, 0xfc3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42a032
cmp byte [edi], 0xc
jne 0x42a032
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42a037
lea edi, [esi + 0x27000]
mov eax, dword [edi]
or eax, eax
je 0x42a0af
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2a160]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2a1ec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42a064
mov ecx, edi
jns 0x42a093
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2a1f0]
or eax, eax
je 0x42a0a9
mov dword [ebx], eax
add ebx, 4
jmp 0x42a081
call dword [esi + 0x2a200]
mov ebp, dword [esi + 0x2a1f4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42a0e3
sub esp, 0xffffff80
jmp 0x41939c
Function at 0x1004a60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
push 0x100
lea eax, [ebp - 0x200]
push eax
mov esi, ecx
push 0xbb7
push dword [esi + 0x2c]
call fcn.0101c6ab
test eax, eax
jne 0x1004a9c
lea eax, [ebp - 0x200]
push 0x1004a48
push eax
call fcn.010124dc
pop ecx
pop ecx
push dword [ebp + 0xc]
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.01012506
mov esi, dword [esi + 4]
add esp, 0xc
push 0x10010
lea eax, [ebp - 0x400]
push eax
push dword [ebp + 8]
push esi
call fcn.0101c483
dec eax
pop esi
je 0x1004ae0
dec eax
dec eax
je 0x1004ae0
dec eax
jne 0x1004aef
call dword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x1004aef
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret 8

Function at 0x1006bde
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
cmp esi, 0x104
mov dword [ebp - 8], edi
jb 0x1006d23
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0xc]
push eax
push 0x1006b5e
lea ebx, [ecx + 0x1290]
push 0x1006b86
push ebx
mov dword [ebp + 0xc], edi
mov dword [ebp - 0xc], esi
call fcn.0101b4ce
cmp dword [ebp + 0xc], edi
mov edi, dword [ebp + 8]
lea eax, [esi - 2]
push eax
je 0x1006c6a
push dword [ebp + 0xc]
push edi
call fcn.01012575
and word [edi + esi*2 - 4], 0
add esp, 0xc
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call fcn.01012925
cmp word [edi + eax*2 - 2], 0x5c
pop ecx
je 0x1006c62
push 0x1006b96
push edi
call fcn.010124b2
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x1006d25
push edi
push 0x1006b9a
push 0x1006b9e
push 0x1006bc6
push ebx
call fcn.0101b496
xor ebx, ebx
cmp word [edi], bx
je 0x1006c9d
push edi
call fcn.01012925
cmp word [edi + eax*2 - 2], 0x5c
pop ecx
je 0x1006c62
push 0x1006bd6
jmp 0x1006c5a
lea eax, [ebp - 4]
push eax
push 5
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x1006cf2
cmp dword [ebp - 4], ebx
je 0x1006cf2
push edi
push dword [ebp - 4]
call fcn.0101d4f8
test eax, eax
jl 0x1006cca
mov dword [ebp - 8], 1
lea eax, [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x1006ced
mov eax, dword [ebp + 8]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 8], ebx
jne 0x1006cfd
push edi
push esi
call fcn.0101c293
test eax, eax
je 0x1006d23
push edi
call fcn.01012925
cmp eax, 1
pop ecx
jl 0x1006c62
cmp word [edi + eax*2 - 2], 0x5c
je 0x1006c62
push 0x1006bda
jmp 0x1006c5a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100712a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, ebx
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
je 0x1007226
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x1007226
lea eax, [ebp - 4]
push eax
mov word [esi], bx
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jl 0x1007219
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x1007226
mov ecx, dword [eax]
push ebx
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp + 0xc]
push edx
push 0x10070d8
push ebx
push ebx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x10071aa
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x114]
push edx
push 1
push dword [ebp - 0xc]
push eax
call dword [ecx + 0x2c]
test eax, eax
jge 0x10071d9
lea eax, [ebp - 8]
push eax
push 5
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x1007219
cmp dword [ebp - 8], ebx
je 0x1007219
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x114]
push edx
push 1
push dword [ebp - 8]
push eax
call dword [ecx + 0x2c]
test eax, eax
jl 0x1007219
lea eax, [ebp + 8]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x114]
push eax
call fcn.01007f86
test eax, eax
jl 0x1007219
push edi
push dword [ebp + 8]
push esi
call fcn.01012575
add esp, 0xc
push dword [ebp + 8]
mov word [esi + edi*2 - 2], bx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
inc eax
jmp 0x1007228
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x1007226
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x10084e2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push 5
push dword [esp + 0xc]
mov esi, ecx
push 0
call fcn.0101c0d0
test eax, eax
je 0x1008507
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop esi
ret 4

Function at 0x100fe20
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
push 0
push 0
push 0x130b
mov esi, ecx
push 0x3ed
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.0101d035
mov edi, eax
test edi, edi
jl 0x100fe92
cmp edi, 5
jg 0x100fe92
mov eax, dword [esi + 0x14c]
test eax, eax
je 0x100fe5d
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp dword [esi + 0x30], 0
je 0x100fe8d
push 0
push dword [esi + edi*4 + 0x164]
push dword [esi + 4]
push dword [esi + edi*4 + 0x150]
push dword [esi + 0xc]
call fcn.0101be23
push 5
push eax
mov dword [esi + 0x14c], eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
inc eax
jmp 0x100fe94
xor eax, eax
pop edi
pop esi
ret
Function at 0x10118c4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
push edi
xor edi, edi
cmp eax, edi
je 0x1011985
mov ebx, dword [ebp + 8]
cmp ebx, edi
je 0x1011985
cmp dword [esi + 0x230], edi
je 0x101192c
cmp dword [esi + 0x234], edi
je 0x101191f
push edi
lea eax, [ebp + 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [esi]
mov dword [ebp - 4], 0xfeff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x101196b
cmp dword [ebp + 8], 2
jne 0x101196b
mov dword [esi + 0x234], edi
push ebx
call fcn.01012925
mov edi, eax
pop ecx
shl edi, 1
jmp 0x101194d
push edi
push edi
push dword [esi + 0xc]
push dword [esi + 8]
push 0xffffffffffffffff
push ebx
push 0x240
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, edi
je 0x1011970
mov ebx, dword [esi + 8]
lea edi, [eax - 1]
push 0
lea eax, [ebp + 8]
push eax
push edi
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x101196b
cmp dword [ebp + 8], edi
jne 0x101196b
xor eax, eax
inc eax
jmp 0x101198f
push 0xfffffffffffffff9
pop eax
jmp 0x101198f
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x7a
neg eax
sbb eax, eax
and eax, 3
add eax, 0xfffffffc
jmp 0x101198f
neg eax
sbb eax, eax
and eax, 6
add eax, 0xfffffff9
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1012158
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
lea ecx, [ebp - 4]
call fcn.0101d86a
lea ecx, [ebp - 4]
call fcn.0101d86e
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x1012273
push 0xbc6
push dword [ebp + 8]
call fcn.0101c602
lea ecx, [ebp - 0x18]
mov ebx, eax
call fcn.0100d9ce
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp eax, esi
je 0x101227f
mov cx, word [eax]
cmp cx, 0x22
push 2
pop edx
jne 0x10121ca
add eax, edx
mov cx, word [eax]
cmp cx, si
je 0x10121c2
cmp cx, 0x22
jne 0x10121b2
cmp word [eax], 0x22
jne 0x10121e2
jmp 0x10121e0
cmp cx, 0x20
jbe 0x10121e2
add eax, edx
cmp word [eax], 0x20
ja 0x10121d0
jmp 0x10121e2
cmp cx, 0x20
ja 0x10121ea
add eax, edx
mov cx, word [eax]
cmp cx, si
jne 0x10121da
push eax
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push dword [ebp + 8]
call fcn.0100def6
test eax, eax
lea ecx, [ebp - 0x18]
jne 0x101220a
call fcn.0100daee
xor esi, esi
inc esi
jmp 0x1012273
push edi
call fcn.0100da18
mov edi, eax
jmp 0x1012244
lea eax, [ebp - 0x34]
push eax
push ebx
push edi
call fcn.0101d108
test eax, eax
jne 0x1012244
lea eax, [ebp - 0x34]
push eax
push edi
call fcn.0101c5ed
test eax, eax
jne 0x1012244
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x34]
push eax
call fcn.0101c054
push esi
push esi
lea eax, [ebp - 0x34]
push esi
push eax
call fcn.0101c3b1
test eax, eax
jne 0x1012214
lea ecx, [ebp - 0x18]
call fcn.0100ddca
lea ecx, [ebp - 0x18]
call fcn.0100daee
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 4]
call fcn.0101d8b4
pop edi
lea ecx, [ebp - 4]
call fcn.0101d86d
mov eax, esi
jmp 0x1012291
lea ecx, [ebp - 0x18]
call fcn.0100daee
lea ecx, [ebp - 4]
call fcn.0101d86d
xor eax, eax
pop esi
pop ebx
leave
ret 0x10
Function at 0x101307f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
xor eax, eax
cmp edx, dword [eax*8 + 0x1022cb0]
je 0x101309f
inc eax
cmp eax, 0x12
jb 0x1013090
shl eax, 3
cmp edx, dword [eax + 0x1022cb0]
mov dword [ebp + 8], eax
jne 0x101323d
mov ecx, dword [0x1023c94]
cmp ecx, 1
je 0x1013212
test ecx, ecx
jne 0x10130d1
cmp dword [0x1022cac], 1
je 0x1013212
cmp edx, 0xfc
je 0x101323d
and byte [ebp - 8], 0
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x101310c
push 5
pop ecx
mov esi, 0x1001ddc
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10c]
lea ebx, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101311b
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x1013153
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1013133
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x1001dd8
push ebx
call fcn.01015c40
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1013158
sub eax, edx
mov ecx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1022cb4]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x101316f
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.01012a30
mov edx, esp
push 6
pop ecx
mov esi, 0x1001dbc
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101319b
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10131a7
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10131c0
mov eax, dword [ebp + 8]
mov esi, 0x1001db8
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 0x1022cb4]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10131db
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10131e7
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x1001d90
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.01015b3e
add esp, 0xc
jmp 0x101323d
mov ecx, dword [eax + 0x1022cb4]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x101321d
push 0
lea edx, [ebp - 4]
push edx
sub eax, esi
push eax
push ecx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
pop edi
pop esi
pop ebx
leave
ret