joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10176a36
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x101cd7b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
cmp dword [ebx], 0x13
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], eax
jae 0x10176a6e
or eax, 0xffffffff
jmp 0x10176c0b
and word [edi], 0
push 3
mov dword [ebp - 0x10], 0xa87f
mov ax, word [ebp - 0x10]
mov ecx, edi
pop edx
xor ax, word [ecx]
inc ecx
inc ecx
dec edx
jne 0x10176a82
push 0x10
mov word [edi], ax
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.101596b0
push esi
call fcn.1015e340
push 6
push dword [ebp - 8]
mov esi, eax
lea eax, [ebp - 0x24]
push eax
call fcn.1015a240
add esp, 0x1c
cmp esi, 8
jb 0x10176ac6
mov eax, dword [ebp - 0x2c]
lea eax, [eax + esi - 8]
push 8
push eax
lea eax, [ebp - 0x1c]
jmp 0x10176acf
push esi
push dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
sub eax, esi
push eax
call fcn.1015a240
mov esi, dword [ebp - 0x28]
add esp, 0xc
mov byte [esi], 0x30
push 6
inc esi
lea eax, [ebp - 0x14]
push edi
mov byte [esi], 0x31
push eax
inc esi
call fcn.1015a240
add esp, 0xc
push 6
pop edi
call fcn.1015a06d
mov byte [ebp + edi - 0x14], al
inc edi
cmp edi, 8
jb 0x10176af5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
call fcn.10176990
movzx eax, byte [ebp - 0xc]
pop ecx
pop ecx
mov ecx, eax
shr ecx, 4
mov cl, byte [ecx + 0x101a7964]
mov byte [esi], cl
inc esi
push 0xf
pop ecx
and eax, ecx
mov al, byte [eax + 0x101a7964]
mov byte [esi], al
movzx eax, byte [ebp - 0xb]
mov edx, eax
shr edx, 4
mov dl, byte [edx + 0x101a7964]
and eax, ecx
inc esi
mov byte [esi], dl
mov al, byte [eax + 0x101a7964]
inc esi
mov byte [esi], al
movzx eax, byte [ebp - 0xa]
mov edx, eax
shr edx, 4
mov dl, byte [edx + 0x101a7964]
and eax, ecx
inc esi
mov byte [esi], dl
mov al, byte [eax + 0x101a7964]
inc esi
mov byte [esi], al
movzx eax, byte [ebp - 9]
mov edx, eax
shr edx, 4
mov dl, byte [edx + 0x101a7964]
and eax, ecx
inc esi
mov byte [esi], dl
mov al, byte [eax + 0x101a7964]
inc esi
mov byte [esi], al
movzx eax, byte [ebp - 8]
mov edx, eax
shr edx, 4
mov dl, byte [edx + 0x101a7964]
and eax, ecx
inc esi
mov byte [esi], dl
mov al, byte [eax + 0x101a7964]
inc esi
mov byte [esi], al
movzx eax, byte [ebp - 7]
mov edx, eax
shr edx, 4
mov dl, byte [edx + 0x101a7964]
and eax, ecx
inc esi
mov byte [esi], dl
mov al, byte [eax + 0x101a7964]
inc esi
mov byte [esi], al
movzx eax, byte [ebp - 6]
mov edx, eax
shr edx, 4
mov dl, byte [edx + 0x101a7964]
inc esi
mov byte [esi], dl
and eax, ecx
mov al, byte [eax + 0x101a7964]
inc esi
mov byte [esi], al
movzx eax, byte [ebp - 5]
inc esi
mov edx, eax
shr edx, 4
mov dl, byte [edx + 0x101a7964]
mov byte [esi], dl
and eax, ecx
mov al, byte [eax + 0x101a7964]
inc esi
mov byte [esi], al
inc esi
mov byte [esi], 0
sub esi, dword [ebp - 0x28]
xor eax, eax
mov dword [ebx], esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10159cce
leave
ret
Function at 0x101779cf
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x18], ecx
ret
Function at 0x10056d8
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10280b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
mov ebx, 0x208
push ebx
lea eax, [ebp - 0x20c]
push edi
push eax
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi], edi
call fcn.01008e20
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1005759
push 0x1001338
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01005637
test eax, eax
je 0x1005759
push ebx
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.01008e20
add esp, 0xc
cmp word [ebp - 0x20c], di
push 0x100132c
je 0x1005770
lea eax, [ebp - 0x20c]
push eax
jmp 0x1005775
push 0x100130c
call fcn.01015770
pop ecx
pop ecx
push 0x10012dc
call fcn.01015547
pop ecx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01008e04
leave
ret
Function at 0x1006723
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x10280b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push 0x1001ba8
push dword [esi + 0x1278]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edi, edi
cmp eax, edi
je 0x10067d8
lea ecx, [ebp - 0x220]
push ecx
mov ecx, dword [esi + 0x1068]
mov dword [ebp - 0x220], edi
push dword [ecx + 4]
call eax
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
pop ecx
je 0x10067d8
lea eax, [ebp - 0x218]
push eax
push 0xf003f
push edi
add esi, 0x106c
push esi
push 0x80000001
mov dword [ebp - 0x218], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10067d1
push 4
lea eax, [ebp - 0x21c]
push eax
push 4
push edi
push 0x1001b9c
push dword [ebp - 0x218]
mov dword [ebp - 0x21c], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x10068f8
lea eax, [ebp - 0x214]
push eax
push 0xf003f
push edi
lea eax, [esi + 0x106c]
push eax
push 0x80000001
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x224], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10068bf
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push edi
mov ebx, 0x1001b9c
push ebx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
mov dword [ebp - 0x21c], eax
je 0x100686b
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x53c
push dword [esi + 0x1274]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x20c]
push eax
call fcn.01009d27
pop ecx
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0x12c
jg 0x1006880
cmp dword [ebp - 0x210], 2
jge 0x100688a
mov dword [ebp - 0x210], 0xa
cmp dword [ebp - 0x21c], edi
je 0x10068ab
push 4
lea eax, [ebp - 0x210]
push eax
push 4
push edi
push ebx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x210]
jmp 0x10068f8
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x53c
push dword [esi + 0x1274]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x20c]
push eax
call fcn.01009d27
cmp eax, 0x12c
pop ecx
jg 0x10068f5
cmp eax, 2
jge 0x10068f8
push 0xa
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01008e04
leave
ret

Function at 0x1006d54
Capabilities:
Read .ini file

Disassembly:
xor eax, eax
lea edx, [ecx + 0xe54]
cmp word [edx], ax
je 0x1006d75
push edx
push eax
push 0x10020cc
add ecx, 0x83c
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
ret
Function at 0x1006ecf
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x10280b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x44
pop ebx
push ebx
lea eax, [ebp - 0x468]
push 0
push eax
call fcn.01008e20
mov dword [ebp - 0x468], ebx
push 0x410
xor ebx, ebx
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.01008e20
push edi
push esi
push 0x10021ac
lea eax, [ebp - 0x414]
push 0x208
push eax
call fcn.01005678
add esp, 0x2c
test eax, eax
je 0x1006f3c
xor eax, eax
jmp 0x1006f8e
lea eax, [ebp - 0x414]
push eax
push 0x100217c
call fcn.010155fa
pop ecx
pop ecx
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x468]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1006f38
push dword [ebp - 0x420]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x424]
call esi
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01008e04
leave
ret 8

Function at 0x1007912
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
push 0
mov esi, ecx
push 0x104
lea edi, [esi + 0x106c]
push edi
lea eax, [ebp - 4]
push eax
lea ebx, [esi + 0x83c]
push ebx
lea eax, [esi + 0x42c]
push eax
lea eax, [esi + 0x634]
push eax
call fcn.0101a0a5
push edi
push 0x1002620
call fcn.010155fa
add esp, 0x24
cmp word [edi], 0
jne 0x10079a4
mov ecx, esi
call fcn.01006eb9
test eax, eax
jne 0x10079a0
push 0x4c6
push dword [esi + 0x1274]
push dword [esi + 0x428]
call fcn.0100648b
add esp, 0xc
test eax, eax
jne 0x10079a0
push eax
push 0x100151c
push 0x10025d8
push dword [esi + 0x428]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x10079e4
lea eax, [esi + 0xe54]
push eax
push ebx
push edi
call fcn.010198e4
add esp, 0xc
test eax, eax
je 0x1007961
lea eax, [esi + 0xe54]
push eax
push 0
push 0x10025ac
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push eax
push 0x1002580
mov dword [esi + 0x1288], eax
call fcn.010156ba
pop ecx
xor eax, eax
pop ecx
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10079ee
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push dword [esi + 0x1288]
mov ecx, dword [esi + 0x1068]
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.010062a7
mov ecx, dword [esi + 0x1068]
mov dword [ebp - 0xc], eax
call fcn.01006376
test eax, eax
jne 0x1007ac9
lea eax, [ebp - 4]
push eax
push 0xf003f
push ebx
lea eax, [esi + 0x106c]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1007a88
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x1002664
push dword [ebp - 4]
call edi
push 0x1002654
push dword [ebp - 4]
call edi
mov eax, dword [esi + 0x1068]
push 4
add eax, 0x18
push eax
push 4
push ebx
push 0x1002640
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [esi + 0x1068]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], ebx
call fcn.01006388
cmp dword [ebp - 8], ebx
jle 0x1007aa8
push 8
mov ecx, esi
call fcn.01007110
cmp dword [ebp - 0xc], 1
je 0x1007ac9
mov ecx, esi
call fcn.01006993
test eax, eax
jne 0x1007abd
xor eax, eax
jmp 0x1007acc
mov eax, dword [esi + 0x1068]
cmp dword [eax + 0xc], 1
je 0x1007ab9
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret
Function at 0x1008435
Capabilities:
Read .ini file

Disassembly:
push 0x20
mov eax, 0x1025864
call fcn.010095e2
mov esi, ecx
mov dword [ebp - 0x28], esi
push 0x1002d6c
call fcn.01015547
mov eax, dword [esi + 0x1068]
push dword [eax + 0x10]
push 0x1002d40
call fcn.010156ba
mov eax, dword [esi + 0x1068]
add esp, 0xc
cmp dword [eax + 0x10], 2
je 0x100868d
mov edx, dword [eax + 0x1c]
xor edi, edi
inc edi
push edx
mov ecx, esi
mov dword [ebp - 0x14], edi
call fcn.01006a9a
cmp eax, edi
je 0x1008495
cmp edx, 0xb
je 0x1008495
cmp edx, 0xe
jne 0x1008499
and dword [ebp - 0x14], 0
lea edi, [esi + 0x634]
push edi
mov ecx, esi
call fcn.01006b5b
mov ebx, eax
lea eax, [esi + 0x42c]
push eax
push edi
mov ecx, esi
call fcn.01007c02
push dword [ebp - 0x14]
mov edi, eax
push 0x1002d18
call fcn.010156ba
push ebx
push 0x1002ce4
call fcn.010156ba
push edi
push 0x1002cb4
call fcn.010156ba
add esp, 0x18
cmp ebx, 1
je 0x1008663
xor ebx, ebx
cmp dword [ebp - 0x14], ebx
jne 0x1008665
cmp edi, ebx
jg 0x1008665
mov dword [ebp - 4], ebx
jne 0x10085da
mov eax, dword [esi + 0x1068]
cmp dword [eax + 0x1c], 0xe
jne 0x1008542
lea eax, [esi + 0xe54]
push eax
push 3
push 0x1002c84
lea eax, [esi + 0x83c]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, dword [esi + 4]
jae 0x1008542
mov dword [ebp - 0x18], ebx
push 0x1025f40
lea eax, [ebp - 0x18]
push eax
call fcn.010096d7
mov eax, dword [esi + 0x1068]
mov edx, dword [eax + 0x1c]
push edx
mov ecx, esi
call fcn.01006a9a
xor edi, edi
inc edi
cmp eax, edi
jne 0x100858a
cmp edx, edi
je 0x100858a
lea eax, [esi + 0xe54]
push eax
push 0xa
push 0x1002c68
lea eax, [esi + 0x83c]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, dword [esi]
jae 0x100858a
mov dword [ebp - 0x1c], ebx
push 0x1025f40
lea eax, [ebp - 0x1c]
jmp 0x100853c
mov eax, dword [esi + 0x1068]
mov edx, dword [eax + 0x1c]
push edx
mov ecx, esi
call fcn.01006a9a
cmp eax, edi
je 0x10085a8
cmp edx, 0xb
jne 0x100865f
lea eax, [esi + 0xe54]
push eax
push edi
push 0x1002c3c
lea eax, [esi + 0x83c]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, dword [esi]
jae 0x100865f
mov dword [ebp - 0x20], ebx
push 0x1025f40
lea eax, [ebp - 0x20]
jmp 0x100853c
lea eax, [esi + 0xe54]
push eax
push 0xa
push 0x1002c68
lea eax, [esi + 0x83c]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, dword [esi]
jae 0x100865f
mov dword [ebp - 0x24], ebx
push 0x1025f40
lea eax, [ebp - 0x24]
jmp 0x100853c
inc dword [esi]
jmp 0x100868d
xor ebx, ebx
push 0x1002bd8
call fcn.01015547
lea edi, [esi + 0x1284]
mov eax, dword [edi]
cmp eax, ebx
pop ecx
je 0x100868d
push eax
push dword [esi + 0x428]
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [edi], ebx
mov dword [esi], ebx
xor eax, eax
call fcn.01009696
ret
Function at 0x100869a
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 0x1002e2c
mov edi, ecx
call fcn.01015547
mov dword [esp], 0x1002df4
call fcn.01015547
pop ecx
push 0xffffffffffffffff
lea esi, [edi + 0x1280]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x1002dbc
call fcn.01015547
pop ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi], 0
lea eax, [edi + 0xe54]
push eax
push 0x3e8
push 0x1002d9c
lea eax, [edi + 0x83c]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, eax
push ebx
call esi
mov ecx, edi
call fcn.01007f51
test eax, eax
je 0x1008755
push ebx
call esi
xor ebx, ebx
jmp 0x100874d
cmp dword [0x10294b0], ebx
je 0x1008732
mov ecx, edi
call fcn.01008435
test eax, eax
jne 0x1008755
mov dword [0x10294b0], ebx
mov ecx, edi
call fcn.010083e6
test eax, eax
jne 0x1008755
mov ecx, edi
call fcn.01006723
imul eax, eax, 0x3e8
push eax
call esi
cmp dword [0x10294ac], ebx
je 0x1008719
mov ecx, edi
call fcn.0100668e
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x1009e3b
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 4], ebx
jne 0x1009e6c
call fcn.0100c40e
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.0100c3b7
add esp, 0x14
or eax, 0xffffffff
jmp 0x1009ee8
push esi
call fcn.0100abdf
push 0x214
push 1
call fcn.0100edc0
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x1009ed0
call fcn.0100adac
push dword [eax + 0x6c]
push esi
call fcn.0100ac72
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x58], eax
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
pop ecx
pop ecx
mov dword [esi + 0x54], edi
jne 0x1009ead
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x1009dbf
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
jne 0x1009ee7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push esi
call fcn.0100c466
cmp dword [ebp - 4], ebx
pop ecx
je 0x1009ee5
push dword [ebp - 4]
call fcn.0100c43e
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret
Function at 0x1009f4b
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], esi
cmp edi, dword [esi*8 + 0x10280c8]
je 0x1009f71
inc esi
cmp esi, 0x17
mov dword [ebp - 4], esi
jb 0x1009f5f
cmp esi, 0x17
jae 0x100a0cb
push 3
call fcn.0100f326
cmp eax, 1
pop ecx
je 0x100a095
push 3
call fcn.0100f326
test eax, eax
pop ecx
jne 0x1009fa4
cmp dword [0x10280b4], 1
je 0x100a095
cmp edi, 0xfc
je 0x100a0cb
push 0x100352c
mov edi, 0x314
push edi
mov esi, 0x1029508
push esi
call fcn.0100f2b9
add esp, 0xc
test eax, eax
je 0x1009fda
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0100c30c
add esp, 0x14
mov byte [0x1029625], bl
push 0x104
mov ebx, 0x1029521
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100a01d
push 0x1003514
push 0x2fb
push ebx
call fcn.0100f2b9
add esp, 0xc
test eax, eax
je 0x100a01d
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0100c30c
add esp, 0x14
push ebx
push edi
push esi
call fcn.0100f240
add esp, 0xc
xor ebx, ebx
test eax, eax
je 0x100a03b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0100c30c
add esp, 0x14
push 0x1003510
push edi
push esi
call fcn.0100f240
add esp, 0xc
test eax, eax
je 0x100a05b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0100c30c
add esp, 0x14
mov eax, dword [ebp - 4]
push dword [eax*8 + 0x10280cc]
push edi
push esi
call fcn.0100f240
add esp, 0xc
test eax, eax
je 0x100a080
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0100c30c
add esp, 0x14
push 0x12010
push 0x10034e8
push esi
call fcn.0100f09b
add esp, 0xc
jmp 0x100a0cb
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
cmp edi, ebx
je 0x100a0cb
cmp edi, 0xffffffff
je 0x100a0cb
mov edx, dword [esi*8 + 0x10280cc]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100a0b4
push ebx
lea eax, [ebp - 8]
push eax
sub ecx, esi
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100a63e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1029a2c]
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp eax, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 4], ebx
jne 0x100a68d
call edi
mov esi, eax
cmp esi, ebx
je 0x100a673
mov dword [0x1029a2c], 1
jmp 0x100a692
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x100a688
push 2
pop eax
mov dword [0x1029a2c], eax
jmp 0x100a68d
mov eax, dword [0x1029a2c]
cmp eax, 1
jne 0x100a6ed
cmp esi, ebx
jne 0x100a6a5
call edi
mov esi, eax
cmp esi, ebx
jne 0x100a6a5
xor eax, eax
jmp 0x100a7bc
cmp word [esi], bx
mov eax, esi
je 0x100a6ba
inc eax
inc eax
cmp word [eax], bx
jne 0x100a6ac
inc eax
inc eax
cmp word [eax], bx
jne 0x100a6ac
sub eax, esi
inc eax
inc eax
push eax
mov dword [ebp - 4], eax
call fcn.0100e223
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x100a6de
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
jmp 0x100a7bc
push dword [ebp - 4]
push esi
push edi
call fcn.0100f3f0
add esp, 0xc
jmp 0x100a6d0
cmp eax, 2
je 0x100a6f6
cmp eax, ebx
jne 0x100a69e
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 8], esi
je 0x100a69e
cmp byte [esi], bl
je 0x100a737
push ebx
push ebx
push 0xffffffffffffffff
push esi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x100a69e
add dword [ebp - 4], eax
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100a723
sub eax, edi
lea esi, [esi + eax + 1]
cmp byte [esi], bl
jne 0x100a709
mov esi, dword [ebp - 8]
inc dword [ebp - 4]
push 2
push dword [ebp - 4]
call fcn.0100edc0
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], edi
jne 0x100a75b
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x100a69e
mov eax, dword [ebp - 8]
cmp byte [eax], bl
je 0x100a7ad
mov ecx, dword [ebp - 4]
mov eax, edi
sub eax, dword [ebp - 0xc]
sar eax, 1
sub ecx, eax
push ecx
push edi
push 0xffffffffffffffff
push esi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x100a7c1
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x100a785
sub eax, ecx
lea esi, [esi + eax + 1]
mov eax, edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x100a797
sub eax, ecx
sar eax, 1
cmp byte [esi], bl
lea edi, [edi + eax*2 + 2]
jne 0x100a762
push dword [ebp - 8]
mov word [edi], bx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 0xc]
call fcn.0100c466
pop ecx
push dword [ebp - 8]
jmp 0x100a750
Function at 0x100a7d4
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1029a30]
test eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jne 0x100a818
call esi
test eax, eax
je 0x100a7fd
mov dword [0x1029a30], 1
jmp 0x100a81d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x100a814
mov dword [0x1029a30], 2
jmp 0x100a826
xor eax, eax
jmp 0x100a87c
cmp eax, 1
jne 0x100a821
call esi
jmp 0x100a87c
cmp eax, 2
jne 0x100a814
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
push eax
push 1
push 0
mov dword [ebp - 8], eax
call esi
mov edi, eax
test edi, edi
je 0x100a879
push 2
push edi
call fcn.0100edc0
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 4], eax
je 0x100a879
push edi
push eax
push 0xffffffffffffffff
push dword [ebp - 8]
push 1
push 0
call esi
test eax, eax
je 0x100a870
mov eax, dword [ebp - 4]
jmp 0x100a87b
push dword [ebp - 4]
call fcn.0100c466
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x100e530
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x100e543
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100e53f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x100e570
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x100e5af
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x100e5a5
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x100e5b1
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x100e595
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret