joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63e89c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x63e9dc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x63e9f0
call fcn.00404bd0
lea edx, [ebp - 0xc]
mov eax, dword [ebx + 0x3a4]
call fcn.00448cdc
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.004094e8
cmp dword [ebp - 8], 0
je 0x63e90e
push dword [ebp - 4]
push 0x63eb78
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 0x3a4]
call fcn.00448cdc
push dword [ebp - 0x10]
push 0x63eb94
lea eax, [ebp - 4]
mov edx, 4
call fcn.00404eb0
lea eax, [ebp - 4]
mov edx, 0x63eba0
call fcn.00404df8
mov eax, dword [0x66a0f4]
mov edx, 0x63ebac
call fcn.00404b8c
mov eax, dword [0x66a0f4]
add eax, 4
mov edx, 0x63ebc0
call fcn.00404b8c
mov eax, dword [0x66a0f4]
add eax, 8
mov edx, 0x63ebd0
call fcn.00404b8c
lea edx, [ebp - 0x14]
mov eax, dword [ebx + 0x360]
call fcn.00448cdc
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00661bb4
test al, al
je 0x63e9b4
mov edx, dword [0x669b18]
mov edx, dword [edx]
mov eax, dword [ebx + 0x360]
call fcn.00448d0c
mov edx, dword [0x669b18]
mov edx, dword [edx + 4]
mov eax, dword [ebx + 0x3a4]
call fcn.00448d0c
mov edx, dword [0x669b18]
mov edx, dword [edx + 8]
mov eax, dword [ebx + 0x37c]
call fcn.0048819c
mov eax, dword [ebx + 0x364]
mov edx, dword [eax]
call dword [edx + 0xc0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63e9e3
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404b5c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b5c
ret

Function at 0x6495dc
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x64966b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x649680
call fcn.00404bd0
mov eax, dword [0x66a0f4]
mov edx, 0x649740
call fcn.00404b8c
mov eax, dword [0x66a0f4]
add eax, 4
mov edx, 0x649750
call fcn.00404b8c
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00661bb4
test al, al
je 0x649655
mov edx, dword [0x669b18]
mov edx, dword [edx]
mov eax, dword [ebx + 0x328]
call fcn.00448d0c
mov edx, dword [0x669b18]
mov edx, dword [edx + 4]
mov eax, dword [ebx + 0x32c]
call fcn.00448d0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x649672
lea eax, [ebp - 4]
call fcn.00404b38
ret
Function at 0x651528
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x6515c5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x6515d8
call fcn.00404bd0
mov eax, dword [0x66a0f4]
mov edx, 0x651640
call fcn.00404b8c
mov eax, dword [0x66a0f4]
add eax, 4
mov edx, 0x651650
call fcn.00404b8c
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00661bb4
test al, al
je 0x6515af
mov edx, dword [0x669b18]
mov edx, dword [edx]
mov eax, dword [ebx + 0x33c]
call fcn.00448d0c
mov edx, dword [0x669b18]
mov edx, dword [edx + 4]
mov eax, dword [ebx + 0x34c]
call fcn.00448d0c
mov eax, dword [ebx + 0x300]
mov edx, dword [eax]
call dword [edx + 0xc0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6515cc
lea eax, [ebp - 4]
call fcn.00404b38
ret
Function at 0x6632c8
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fd8
xor eax, eax
push ebp
push 0x663342
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004094e8
cmp dword [ebp - 8], 0
jne 0x66330e
mov eax, ebx
mov edx, 0x663358
call fcn.00404b8c
jmp 0x663327
push 0x66341c
push dword [ebp - 4]
push 0x6634f4
mov eax, ebx
mov edx, 3
call fcn.00404eb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x663349
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b5c
ret

Function at 0x6634fc
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404fd8
xor eax, eax
push ebp
push 0x663576
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004094e8
cmp dword [ebp - 8], 0
jne 0x663542
mov eax, ebx
mov edx, 0x66358c
call fcn.00404b8c
jmp 0x66355b
push 0x663650
push dword [ebp - 4]
push 0x663728
mov eax, ebx
mov edx, 3
call fcn.00404eb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66357d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b5c
ret

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x101bb72
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
push esi
push 0x100
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 0xc], eax
cmp eax, esi
je 0x101bbff
cmp eax, 0xffffffff
je 0x101bbff
push ebx
push edi
push 0x17
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
je 0x101bbea
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
je 0x101bbea
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, esi
je 0x101bbf2
push esi
lea ecx, [ebp + 8]
push ecx
push ebx
push eax
push dword [ebp + 0xc]
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x101bbf2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
jmp 0x101bc07
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x101f4da
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 3
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x101f50f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x101f553
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x101f54b
cmp edi, esi
jbe 0x101f54b
push esi
lea eax, [ebp + 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101f54b
cmp dword [ebp - 4], esi
jbe 0x101f54b
xor edx, edx
mov eax, edi
div dword [ebp - 4]
add dword [0x10566e4], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1023b75
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
cmp ebx, 0x10000
jbe 0x1023bcf
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp + 0x10]
push eax
push dword [esi + 0x10004]
lea eax, [esi + 4]
push eax
push dword [esi]
call edi
mov eax, dword [ebp + 0x10]
add dword [esi + 0x10008], eax
and dword [esi + 0x10004], 0
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call edi
mov eax, dword [ebp + 0x10]
add dword [esi + 0x10008], eax
pop edi
jmp 0x1023c22
mov eax, dword [esi + 0x10004]
lea ecx, [eax + ebx]
cmp ecx, 0xffff
jbe 0x1023c03
push 0
lea ecx, [ebp + 0x10]
push ecx
push eax
lea eax, [esi + 4]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 0x10]
add dword [esi + 0x10008], eax
and dword [esi + 0x10004], 0
mov eax, dword [esi + 0x10004]
push ebx
push dword [ebp + 8]
lea eax, [eax + esi + 4]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
add dword [esi + 0x10004], ebx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x1023ccf
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
cmp byte [esi + 0x1000c], 0
push edi
jne 0x1023d0d
push dword [ebp + 8]
call fcn.01023c2d
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
je 0x1023df8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1023d00
sub eax, edx
mov ebx, eax
jmp 0x1023d26
mov edi, dword [ebp + 8]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1023d15
sub eax, edx
sar eax, 1
lea ebx, [eax + eax]
mov dword [ebp + 0xc], edi
cmp ebx, 0x10000
jbe 0x1023d8e
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp + 8]
push eax
push dword [esi + 0x10004]
lea eax, [esi + 4]
push eax
push dword [esi]
call edi
mov eax, dword [ebp + 8]
add dword [esi + 0x10008], eax
and dword [esi + 0x10004], 0
push 0
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi]
call edi
mov eax, dword [ebp + 8]
add dword [esi + 0x10008], eax
cmp dword [ebp - 4], 0
je 0x1023d89
push dword [ebp - 4]
push 0
push dword [0x10576f8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 8]
jmp 0x1023df8
mov eax, dword [esi + 0x10004]
lea ecx, [eax + ebx]
cmp ecx, 0xffff
jbe 0x1023dc2
push 0
lea ecx, [ebp + 8]
push ecx
push eax
lea eax, [esi + 4]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
add dword [esi + 0x10008], eax
and dword [esi + 0x10004], 0
mov eax, dword [esi + 0x10004]
push ebx
push dword [ebp + 0xc]
lea eax, [eax + esi + 4]
push eax
call sub.msvcrt.dll_memcpy
add dword [esi + 0x10004], ebx
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x1023df6
push dword [ebp - 4]
push 0
push dword [0x10576f8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1023e04
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1023e0f
sub eax, edx
push ebx
mov ebx, eax
push esi
mov esi, dword [ebp + 0xc]
cmp ebx, 0x10000
jbe 0x1023e6c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp + 0xc]
push eax
push dword [esi + 0x10004]
lea eax, [esi + 4]
push eax
push dword [esi]
call edi
mov eax, dword [ebp + 0xc]
add dword [esi + 0x10008], eax
and dword [esi + 0x10004], 0
push 0
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
push dword [esi]
call edi
mov eax, dword [ebp + 0xc]
add dword [esi + 0x10008], eax
pop edi
jmp 0x1023ebf
mov eax, dword [esi + 0x10004]
lea ecx, [eax + ebx]
cmp ecx, 0xffff
jbe 0x1023ea0
push 0
lea ecx, [ebp + 0xc]
push ecx
push eax
lea eax, [esi + 4]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 0xc]
add dword [esi + 0x10008], eax
and dword [esi + 0x10004], 0
mov eax, dword [esi + 0x10004]
push ebx
push dword [ebp + 8]
lea eax, [eax + esi + 4]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
add dword [esi + 0x10004], ebx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1023eca
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
cmp byte [esi + 0x1000c], 0
push edi
jne 0x1023eed
mov al, byte [ebp + 8]
xor edi, edi
inc edi
mov byte [ebp + 0xf], al
lea ebx, [ebp + 0xf]
jmp 0x1023ef3
push 2
pop edi
lea ebx, [ebp + 8]
mov eax, dword [esi + 0x10004]
lea ecx, [eax + edi]
cmp ecx, 0xffff
jbe 0x1023f27
push 0
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [esi + 4]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
add dword [esi + 0x10008], eax
and dword [esi + 0x10004], 0
mov eax, dword [esi + 0x10004]
push edi
lea eax, [eax + esi + 4]
push ebx
push eax
call sub.msvcrt.dll_memcpy
add dword [esi + 0x10004], edi
add esp, 0xc
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 8

Function at 0x1023f51
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx + 0x10004]
lea ecx, [eax + 1]
push esi
push edi
cmp ecx, 0xffff
jbe 0x1023f90
push 0
lea ecx, [ebp + 0xc]
push ecx
push eax
lea eax, [ebx + 4]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 0xc]
add dword [ebx + 0x10008], eax
and dword [ebx + 0x10004], 0
mov eax, dword [ebx + 0x10004]
lea edi, [eax + ebx + 4]
lea esi, [ebp + 8]
movsb byte es:[edi], byte [esi]
inc dword [ebx + 0x10004]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
pop ebp
ret 8
Function at 0x1023fb3
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x1023fc4
xor eax, eax
jmp 0x1024008
mov eax, dword [esi + 0x10004]
test eax, eax
jbe 0x1023ff3
cmp byte [esi + 0x1000d], 0
jne 0x1023ff3
push 0
lea ecx, [ebp + 8]
push ecx
push eax
lea eax, [esi + 4]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
add dword [esi + 0x10008], eax
and dword [esi + 0x10004], 0
dec dword [0x10576fc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
ret 4

Function at 0x1024145
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push ebx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1024170
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1024198
mov eax, dword [ebp + 0x10]
push esi
lea esi, [edi + 0x10004]
push dword [esi]
add edi, 4
add eax, ebx
push edi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esi]
add eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
add esp, 0xc
mov dword [ecx], eax
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x1024264
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov byte [ebp - 1], bl
cmp byte [esi + 0x1000c], bl
jne 0x102433a
push dword [ebp + 0xc]
call fcn.01023c2d
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x1024333
mov eax, dword [esi + 0x10004]
mov edi, 0x10000
jmp 0x10242d3
cmp byte [ebp - 1], bl
jne 0x1024323
push ebx
lea eax, [ebp + 8]
push eax
push dword [esi + 0x10004]
lea eax, [esi + 4]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
add dword [esi + 0x10008], eax
mov dword [esi + 0x10004], ebx
mov byte [ebp - 1], 1
mov eax, ebx
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp - 8]
mov ecx, edi
sub ecx, eax
push ecx
lea eax, [eax + esi + 4]
push eax
call fcn.010241a3
test eax, eax
jl 0x10242a2
mov ecx, dword [esi + 0x10004]
lea eax, [ecx + esi + 4]
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10242fa
push dword [ebp - 8]
sub eax, edi
add ecx, eax
push ebx
mov dword [esi + 0x10004], ecx
push dword [0x10576f8]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 8]
jmp 0x1024335
push dword [ebp - 8]
push ebx
push dword [0x10576f8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [esi + 0x10004]
mov edi, 0x10000
jmp 0x1024378
cmp byte [ebp - 1], bl
jne 0x1024333
push ebx
lea eax, [ebp + 8]
push eax
push dword [esi + 0x10004]
lea eax, [esi + 4]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
add dword [esi + 0x10008], eax
mov dword [esi + 0x10004], ebx
mov byte [ebp - 1], 1
mov eax, ebx
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
mov ecx, edi
sub ecx, eax
push ecx
lea eax, [eax + esi + 4]
push eax
call fcn.01024203
test eax, eax
jl 0x1024347
mov ecx, dword [esi + 0x10004]
lea eax, [ecx + esi + 4]
lea edx, [eax + 2]
mov di, word [eax]
inc eax
inc eax
cmp di, bx
jne 0x102439f
sub eax, edx
sar eax, 1
lea ecx, [ecx + eax*2]
mov dword [esi + 0x10004], ecx
jmp 0x1024335

Function at 0x10243c0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor bl, bl
mov edi, 0x10000
jmp 0x1024402
test bl, bl
jne 0x1024442
push 0
lea eax, [ebp + 8]
push eax
push dword [esi + 0x10004]
lea eax, [esi + 4]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
add dword [esi + 0x10008], eax
and dword [esi + 0x10004], 0
inc bl
mov eax, dword [esi + 0x10004]
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
mov ecx, edi
sub ecx, eax
push ecx
lea eax, [eax + esi + 4]
push eax
call fcn.010241a3
test eax, eax
jl 0x10243d4
mov ecx, dword [esi + 0x10004]
lea eax, [ecx + esi + 4]
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x102442f
sub eax, edi
add ecx, eax
mov dword [esi + 0x10004], ecx
jmp 0x1024444
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1025078
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
push esi
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x10250a2
mov eax, 0x1070
jmp 0x1025154
push ebx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x1017730
push 1
push esi
push 0x1017800
mov byte [edi + 0x694], 1
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
cmp ebx, esi
jl 0x1025125
push 0x1002354
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x10250ed
mov dword [ebp - 0xc], 8
jmp 0x1025125
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 8]
push eax
call dword [ecx + 0xc]
mov ebx, eax
cmp ebx, esi
jl 0x1025125
mov eax, dword [ebp - 0x10]
push esi
push esi
push 3
push 4
push esi
push esi
push 0xa
push eax
mov dword [edi + 0x690], eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x1025135
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], esi
push dword [ebp - 8]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0xc]
cmp eax, esi
jne 0x1025152
cmp ebx, esi
jge 0x1025150
mov eax, 0x1070
jmp 0x1025152
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x1025c3c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
push esi
mov esi, dword [eax + 0x14]
cmp dword [ebp + 0x14], esi
jb 0x1025c71
ja 0x1025c57
cmp dword [ebp + 0x10], ecx
jb 0x1025c71
mov edx, dword [eax + 0x18]
add edx, ecx
mov ecx, dword [eax + 0x1c]
adc ecx, esi
cmp dword [ebp + 0x14], ecx
ja 0x1025c71
jb 0x1025c6d
cmp dword [ebp + 0x10], edx
jae 0x1025c71
mov dl, 1
jmp 0x1025c73
xor dl, dl
movzx ecx, byte [ebp + 0x18]
sub ecx, 0xa
pop esi
je 0x1025d2d
dec ecx
je 0x1025cfc
dec ecx
je 0x1025ccb
dec ecx
dec ecx
jne 0x1025d59
mov ecx, dword [ebp + 8]
test dl, dl
je 0x1025cb2
inc dword [ecx + 0x88]
inc dword [eax + 0x30]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x1025d59
inc dword [eax + 0x30]
jmp 0x1025d59
inc dword [ecx + 0x78]
inc dword [eax + 0x20]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x1025d59
inc dword [eax + 0x20]
jmp 0x1025d59
mov ecx, dword [ebp + 8]
test dl, dl
je 0x1025ce7
inc dword [ecx + 0x94]
inc dword [eax + 0x3c]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x1025d59
inc dword [eax + 0x3c]
jmp 0x1025d59
inc dword [ecx + 0x84]
inc dword [eax + 0x2c]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x1025d59
inc dword [eax + 0x2c]
jmp 0x1025d59
mov ecx, dword [ebp + 8]
test dl, dl
je 0x1025d18
inc dword [ecx + 0x90]
inc dword [eax + 0x38]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x1025d59
inc dword [eax + 0x38]
jmp 0x1025d59
inc dword [ecx + 0x80]
inc dword [eax + 0x28]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x1025d59
inc dword [eax + 0x28]
jmp 0x1025d59
mov ecx, dword [ebp + 8]
test dl, dl
je 0x1025d49
inc dword [ecx + 0x8c]
inc dword [eax + 0x34]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x1025d59
inc dword [eax + 0x34]
jmp 0x1025d59
inc dword [ecx + 0x7c]
inc dword [eax + 0x24]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x1025d59
inc dword [eax + 0x24]
pop ebp
ret 0x14
Function at 0x102f1b2
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0101ca90
mov eax, dword [0x1055908]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, 0x400
push esi
lea ecx, [ebp - 0x1004]
mov dword [ebp - 0x1018], eax
mov eax, dword [ebp + 0xc]
push ecx
push eax
xor edi, edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, edi
je 0x102f314
cmp eax, esi
jae 0x102f314
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1008]
push eax
lea ebx, [ebp - 0x804]
mov eax, ebx
push eax
lea eax, [ebp - 0x100c]
push eax
push edi
lea eax, [ebp - 0x1004]
push eax
mov dword [ebp - 0x1008], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileMUIPath]
push edi
mov dword [ebp - 0x100c], edi
mov dword [ebp - 0x1014], edi
mov dword [ebp - 0x1010], edi
call esi
test eax, eax
jne 0x102f255
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x102f257
xor eax, eax
cmp eax, 0x7a
jne 0x102f2e0
lea eax, [ebp - 0x101c]
push eax
mov eax, dword [ebp - 0x1008]
push 2
pop ecx
mul ecx
push edx
push eax
call fcn.0101b8f5
test eax, eax
jl 0x102f336
push dword [ebp - 0x101c]
push 8
push dword [0x10576f8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, edi
je 0x102f336
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1008]
push eax
push ebx
lea eax, [ebp - 0x100c]
push eax
push edi
lea eax, [ebp - 0x1004]
push eax
push edi
mov dword [ebp - 0x100c], edi
mov dword [ebp - 0x1014], edi
mov dword [ebp - 0x1010], edi
call esi
test eax, eax
jne 0x102f2de
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x102f2e0
xor eax, eax
cmp eax, edi
jne 0x102f31a
push ebx
push dword [ebp - 0x1018]
call fcn.0102f0ed
test eax, eax
jne 0x102f31a
cmp ebx, edi
je 0x102f310
lea eax, [ebp - 0x804]
cmp ebx, eax
je 0x102f310
push ebx
push edi
push dword [0x10576f8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
jmp 0x102f338
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, edi
je 0x102f336
lea eax, [ebp - 0x804]
cmp ebx, eax
je 0x102f336
push ebx
push edi
push dword [0x10576f8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101ca75
leave
ret 8
Function at 0x103214f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [edi + 0x10]
mov esi, dword [eax]
cmp esi, eax
je 0x103223b
push ebx
mov ebx, dword [ebp + 8]
push dword [esi + 0x20]
push 0x1004dd0
push ebx
call fcn.01024264
mov eax, dword [edi + 0x3c]
add esp, 0xc
test eax, eax
je 0x1032193
push eax
push 0x1004d8c
push ebx
call fcn.01024264
add esp, 0xc
jmp 0x10321a0
push 0x1004d50
push ebx
call fcn.01024264
pop ecx
pop ecx
push 0x1004d18
push ebx
call fcn.01024264
pop ecx
pop ecx
push dword [esi + 0x24]
push 0
push 1
push ebx
call fcn.0101d200
push 0x100183c
push ebx
call fcn.01024264
mov eax, dword [edi + 0x38]
pop ecx
pop ecx
test eax, eax
jne 0x10321d3
mov eax, 0x1003e24
cmp dword [edi + 0x3c], 0
mov ecx, 0x1004d08
je 0x10321e3
mov ecx, 0x1004cf8
fld qword [esi + 0x10]
sub esp, 0x30
fstp qword [esp + 0x28]
fld qword [esi + 0x80]
fstp qword [esp + 0x20]
fld qword [esi + 0x78]
fstp qword [esp + 0x18]
fld qword [esi + 0x70]
fstp qword [esp + 0x10]
fld qword [esi + 0x48]
fstp qword [esp + 8]
fld qword [esi + 0x40]
fstp qword [esp]
push dword [esi + 0x50]
fld qword [esi + 0x38]
push ecx
push ecx
fstp qword [esp]
push eax
push ecx
push 0x1004a10
push ebx
call fcn.01024264
mov esi, dword [esi]
lea eax, [edi + 0x10]
add esp, 0x4c
cmp esi, eax
jne 0x103216a
pop ebx
pop edi
pop esi
pop ebp
ret 8