joyce8/EMBER2024-capa huggingface dataset:
Function at 0x640f38
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], eax
mov ecx, 7
lea eax, [ebp - 0x20]
mov edx, dword [0x4012b8]
call fcn.0040a268
xor eax, eax
push ebp
push 0x6418a7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x65b1cc], 0
je 0x640f89
xor eax, eax
call fcn.00638030
mov byte [ebp - 0x21], 0
mov eax, dword [0x65365c]
mov eax, dword [eax]
shr eax, 0x10
cmp eax, 0x600
mov eax, dword [0x653204]
setae byte [eax]
xor ecx, ecx
push ebp
push 0x6417e8
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp dword [0x65b1dc], 0
je 0x640fc7
mov dl, 1
mov eax, dword [0x65b1dc]
call fcn.005f3018
cmp byte [0x65b1ca], 0
je 0x641034
xor eax, eax
push ebp
push 0x641007
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x65b1d0], 0
jne 0x640ff3
mov eax, 0x6418c4
call fcn.005f3b5c
jmp 0x640ffd
mov eax, dword [0x65b1d0]
call fcn.005f3d40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x641034
mov eax, 0x64192c
call fcn.005f3d9c
lea eax, [ebp - 0x2c]
mov ecx, dword [0x65b1b4]
mov edx, 0x641990
call fcn.00409a14
mov eax, dword [ebp - 0x2c]
call fcn.005f3d9c
lea eax, [ebp - 0x30]
mov ecx, dword [0x65b1b8]
mov edx, 0x6419d0
call fcn.00409a14
mov eax, dword [ebp - 0x30]
call fcn.005f3d9c
lea eax, [ebp - 0x38]
call fcn.005a3580
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x6419fc
call fcn.00409a14
mov eax, dword [ebp - 0x34]
call fcn.005f3d9c
call fcn.006381e0
xor eax, eax
call fcn.00640864
mov dword [0x65b1c0], eax
mov dl, 1
mov eax, dword [0x63fb10]
call fcn.00610204
mov dword [0x6531b4], eax
mov ecx, dword [0x65b1b8]
mov edx, dword [0x65b1c0]
mov eax, dword [0x6531b4]
call fcn.00612e4c
lea ecx, [ebp - 0x3c]
mov eax, dword [0x6531b4]
mov edx, dword [eax + 0x18]
mov al, 0xc7
call fcn.005ab1a0
mov edx, dword [ebp - 0x3c]
mov eax, 0x65b1c4
call fcn.00408aec
mov eax, dword [0x6531b4]
test byte [eax + 0x1d], 0x20
je 0x64112f
mov eax, dword [0x65332c]
cmp byte [eax], 0
jne 0x64112f
push 1
push 1
mov eax, dword [0x65b1c4]
call fcn.004097c0
push eax
mov eax, dword [0x65377c]
mov eax, dword [eax + 0x354]
call fcn.004097c0
mov ecx, 0x30
pop edx
call fcn.00638ac8
call fcn.00426598
mov eax, dword [0x6531b4]
test byte [eax + 0x1d], 1
je 0x641173
mov eax, dword [0x653588]
cmp byte [eax], 0
jne 0x641173
push 1
push 1
mov eax, dword [0x65b1c4]
call fcn.004097c0
push eax
mov eax, dword [0x65377c]
mov eax, dword [eax + 0x1f8]
call fcn.004097c0
mov ecx, 0x30
pop edx
call fcn.00638ac8
call fcn.00426598
fdivp st(7)
Function at 0x642038
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x6422ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x653768]
mov eax, dword [eax]
mov edx, 0x642308
call fcn.00595f5c
push 5
mov eax, dword [0x653768]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x6422b3
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.006390cc
lea eax, [ebp - 0x10]
call fcn.005a3b4c
mov eax, dword [ebp - 0x10]
call fcn.004216cc
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.005a36a0
mov edx, dword [ebp - 0x14]
mov eax, 0x65b1b4
call fcn.00408aec
call fcn.006403a4
lea ecx, [ebp - 0x18]
mov edx, 0x642328
mov eax, dword [0x65b1b4]
call fcn.005a2760
mov edx, dword [ebp - 0x18]
mov eax, 0x65b1b8
call fcn.00408aec
lea ecx, [ebp - 0x1c]
mov edx, 0x642340
mov eax, dword [0x65b1b4]
call fcn.005a2760
mov edx, dword [ebp - 0x1c]
mov eax, 0x65b1bc
call fcn.00408aec
push 2
push 0
push 1
mov ecx, dword [0x65b1b4]
mov dl, 1
mov eax, dword [0x5a92f4]
call fcn.005a9c50
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x642190
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x24]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.005a9c10
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.005a9be8
cmp dword [ebp - 0xc], 0x67734d49
je 0x64216b
mov cl, 1
xor edx, edx
mov eax, dword [0x65b1bc]
call fcn.005ab34c
jmp 0x64217a
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x65b1b4]
call fcn.005ab34c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x642197
mov eax, dword [ebp - 4]
call fcn.004069c8
ret
Function at 0x642484
Capabilities:
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6425c1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
mov ecx, 0x6425dc
mov edx, ebx
call fcn.00409a14
mov eax, dword [ebp - 0x25c]
call fcn.004097c0
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x64259b
xor eax, eax
push ebp
push 0x642594
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x6425f8
lea eax, [ebp - 0x22c]
mov ecx, 5
call fcn.0042184c
test eax, eax
jne 0x642565
test byte [ebp - 0x258], 0x10
jne 0x642565
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.00409864
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409a14
mov esi, dword [ebp - 0x258]
test esi, 1
je 0x64255d
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.004210cc
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x6424f5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64259b
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6425c8
lea eax, [ebp - 0x260]
mov edx, 2
call fcn.0040876c
lea eax, [ebp - 4]
call fcn.0040870c
ret
Function at 0x642604
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x642702
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.0040870c
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.005a2bf8
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x64271c
call fcn.00421ba4
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00409a14
mov eax, dword [ebp - 8]
call fcn.004097c0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x6426a2
test esi, 0x10
jne 0x6426d2
test esi, 1
je 0x6426a2
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 8]
call fcn.004097c0
push eax
call sub.kernel32.dll_SetFileAttributesW
push 1
mov eax, dword [ebp - 8]
call fcn.004097c0
push eax
mov eax, dword [ebp - 0xc]
call fcn.004097c0
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x6426cc
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00408aec
jmp 0x6426df
inc edi
cmp edi, 0xa
je 0x6426df
inc ebx
cmp ebx, 0x3e8
jne 0x642643
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x642709
lea eax, [ebp - 0x14]
call fcn.0040870c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040876c
ret
Function at 0x401040
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov ebx, dword [eax]
call sym.___p___argv
mov esi, dword [eax]
call sym.__get_initial_narrow_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dbg.main
mov dword [esp], eax
call sym._exit
nop
nop
nop

Function at 0x401100
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call dbg.__main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x40117e
cmp al, 9
je 0x401170
cmp al, 0x20
je 0x401170
mov dword [ebp - 0x54], 0
xor edi, edi
nop
cmp al, 0x5c
je 0x4011d0
cmp al, 0x22
je 0x4011e0
mov dword [ebp - 0x54], 0
add ebx, 1
movzx eax, byte [ebx]
test al, al
je 0x40117e
cmp al, 9
sete cl
cmp al, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x401130
test edi, 1
jne 0x401130
lea esi, [esi]
nop
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x401170
cmp al, 0x20
je 0x401170
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x24], 1
jne 0x401199
mov word [ebp - 0x20], 1
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dbg.WinMain@16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add dword [ebp - 0x54], 1
jmp 0x401147
and dword [ebp - 0x54], 1
jne 0x401140
xor edi, 1
jmp 0x401147
Function at 0x100019d1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x1011a040]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x68]
stosd dword es:[edi], eax
mov esi, edx
push 0x44
mov dword [ebp - 0x6c], esi
mov ebx, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x54]
pop edi
push edi
push 0
push eax
call fcn.10054410
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or dword [ebp - 0x28], 1
xor eax, eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], edi
push eax
xor edi, edi
push edi
push edi
push edi
push edi
push edi
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10001a58
push 0xffffffffffffffff
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x64]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x68]
call esi
xor eax, eax
jmp 0x10001aa2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push edi
mov esi, eax
lea eax, [ebp - 0x58]
push eax
push 0x400
push esi
push edi
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [ebp - 0x58]
mov ecx, str._null_
test ebx, ebx
mov eax, ecx
cmovne eax, ebx
push esi
push eax
mov eax, dword [ebp - 0x6c]
test eax, eax
cmovne ecx, eax
push ecx
push str.cimg::system___:_Command__s__module_name__s__failed_with_error__lu:__s
call fcn.10001981
add esp, 0x14
or eax, 0xffffffff
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10052950
leave
ret
Function at 0x10003302
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
test eax, eax
push ebx
push esi
mov esi, 0x100ce1d0
push edi
cmovne esi, eax
mov edi, ecx
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000331d
sub ecx, edx
lea ebx, [ecx + 1]
test ebx, ebx
je 0x10003348
push ebx
call fcn.10052ec3
push ebx
push esi
push eax
mov dword [ebp - 4], eax
call fcn.10054570
mov esi, dword [ebp - 4]
add esp, 0x10
xor ebx, ebx
jmp 0x1000334c
xor ebx, ebx
mov esi, ebx
cmp dword [edi + 0x18], ebx
je 0x1000335d
cmp dword [edi + 0x1c], ebx
je 0x1000335d
mov ecx, edi
call fcn.10003420
call fcn.10002a7d
mov ecx, dword [ebp + 8]
cmp eax, ecx
cmovb ecx, eax
mov dword [edi + 0x18], ecx
call fcn.10002aba
mov ecx, dword [ebp + 0xc]
cmp eax, ecx
push 3
cmovb ecx, eax
mov word [edi + 0xbc], 0x100
cmp dword [ebp + 0x14], 4
pop eax
cmovb eax, dword [ebp + 0x14]
mov dword [edi + 0x20], eax
mov al, byte [ebp + 0x18]
mov byte [edi + 0x30], al
mov eax, 0x80000000
mov dword [edi + 0x50], eax
mov dword [edi + 0x4c], eax
mov al, byte [ebp + 0x1c]
mov dword [edi + 0x1c], ecx
mov ecx, edi
mov byte [edi + 0x60], al
mov dword [edi + 0x34], esi
call fcn.10002a26
cmp byte [edi + 0x30], 0
je 0x100033c2
mov ecx, edi
call fcn.1000326e
push 8
call fcn.10052ec3
pop ecx
mov esi, eax
push ebx
push ebx
push ebx
mov dword [esi], edi
mov eax, dword [edi + 0x34]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push ebx
push ebx
push ebx
push ebx
mov dword [edi + 0xc8], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push esi
push 0x10002eb6
push ebx
push ebx
mov dword [edi + 0xc4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push dword [edi + 0xc4]
mov dword [edi + 0xc0], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x10003420
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
je 0x100034d8
cmp dword [esi + 0x1c], ebx
je 0x100034d8
push dword [esi + 0xcc]
call dword [sym.imp.USER32.dll_DestroyWindow]
push ebx
push dword [esi + 0xc0]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0xdc]
call fcn.1005295e
push dword [esi + 0x34]
call fcn.1005295e
pop ecx
pop ecx
mov dword [esi + 0xdc], ebx
mov dword [esi + 0x34], ebx
cmp byte [esi + 0x30], bl
je 0x100034a2
mov eax, dword [esi + 0xd0]
test eax, eax
je 0x10003485
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 0xd0], ebx
cmp word [esi + 0x124], bx
je 0x100034a2
push ebx
lea eax, [esi + 0xe0]
push eax
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsW]
and dword [esi + 0x2c], ebx
mov eax, 0x80000000
and dword [esi + 0x28], ebx
mov ecx, esi
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], eax
mov byte [esi + 0x30], bl
mov byte [esi + 0x60], 1
mov dword [esi + 0x34], ebx
call fcn.10002a26
mov eax, esi
pop esi
pop ebx
ret
pop esi
pop ebx
jmp fcn.10002a26

Function at 0x1000390e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10003984
xor eax, eax
push eax
push eax
push esi
push edi
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
test ebx, ebx
je 0x10003984
sub esp, 0xc
lea ecx, [esp + 0x1c]
push ebx
call fcn.10006e05
push ebx
push dword [esp + 0x28]
push esi
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x10003973
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp byte [esp + 0x20], 0
jne 0x10003984
push dword [esp + 0x24]
call fcn.1005295e
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000398d
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1011d888]
push ebx
push esi
xor ebx, ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1011ea7c]
push edi
cmp eax, dword [ecx + 8]
jle 0x100039f9
mov esi, 0x1011ea7c
push esi
call fcn.100529ed
cmp dword [0x1011ea7c], 0xffffffff
pop ecx
jne 0x100039f9
push 0x100967df
mov dword [0x1011ea18], ebx
mov dword [0x1011ea1c], ebx
mov dword [0x1011ea20], ebx
mov dword [0x1011ea24], ebx
mov byte [0x1011ea28], bl
mov dword [0x1011ea2c], ebx
call fcn.10052e9b
pop ecx
push esi
call fcn.1005299c
pop ecx
call fcn.1000187d
push 0xffffffffffffffff
push dword [eax + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x1011ea2c], ebx
jne 0x10003a74
push 1
push 1
push 1
push 0x104
mov ecx, 0x1011ea18
call fcn.10007519
mov eax, dword [0x1011ea2c]
push ebx
push 0x26
mov byte [eax], bl
push dword [0x1011ea2c]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x10003a74
push str.PROGRAMFILES
call fcn.10061093
pop ecx
test eax, eax
je 0x10003a66
push 0x103
push eax
push dword [0x1011ea2c]
call fcn.1005a590
add esp, 0xc
jmp 0x10003a74
mov edi, dword [0x1011ea2c]
mov esi, str.C:PROGRA1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1000187d
push dword [eax + 0x1c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x1011ea2c]
pop edi
pop esi
pop ebx
ret
Function at 0x1000662b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10006655
mov eax, dword [ebp + 8]
push eax
mov dword [0x1011e6e4], eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
push eax
push eax
push eax
push 0x10006d65
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
pop ebp
ret 0xc

Function at 0x1000665c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1011a040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], edx
push esi
push edi
mov dword [ebp - 8], ebx
mov edi, ebx
mov dword [ebp - 8], ebx
xor eax, eax
push 0x258c
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
call fcn.10022925
mov esi, eax
mov dword [esp], 0x258c
push edi
mov dword [ebx], esi
push esi
lea eax, [esi + 0x258c]
mov dword [ebx + 8], eax
call fcn.10054410
lea eax, [esi + 0x258c]
add esp, 0xc
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x14], 7
jbe 0x100066c7
mov eax, dword [eax]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
push edi
mov esi, eax
push 0x52284
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 8]
push eax
push 0x258c
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10052950
leave
ret
Function at 0x1002066d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov eax, ecx
mov dword [esp + 0xc], eax
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test eax, eax
je 0x100206e6
cmp dword [ebp + 8], 0
je 0x100206e6
test edi, edi
jne 0x1002069c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov edi, edx
push dword [ebp + 8]
mov esi, 0x3f00000
cmp edi, esi
cmovb esi, edi
add eax, ebx
push esi
push 1
push eax
call fcn.10060b59
add esp, 0x10
add ebx, eax
sub edi, eax
cmp esi, eax
jne 0x100206cb
mov eax, dword [esp + 0x10]
test edi, edi
jne 0x100206a0
test edi, edi
mov edi, dword [esp + 0x14]
je 0x100206e2
push edi
push ebx
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.10001981
add esp, 0xc
mov eax, ebx
jmp 0x10020695
push eax
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x10106510
mov ecx, 0x100ce1d0
cmovbe eax, ecx
push eax
call fcn.100017f0
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001565
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x10111bdc
push eax
call fcn.10054af0
int3

Function at 0x10020724
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov eax, ecx
mov dword [esp + 0xc], eax
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test eax, eax
je 0x1002079d
cmp dword [ebp + 8], 0
je 0x1002079d
test edi, edi
jne 0x10020753
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov edi, edx
push dword [ebp + 8]
mov esi, 0x3f00000
cmp edi, esi
cmovb esi, edi
add eax, ebx
push esi
push 1
push eax
call fcn.10060b59
add esp, 0x10
add ebx, eax
sub edi, eax
cmp esi, eax
jne 0x10020782
mov eax, dword [esp + 0x10]
test edi, edi
jne 0x10020757
test edi, edi
mov edi, dword [esp + 0x14]
je 0x10020799
push edi
push ebx
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.10001981
add esp, 0xc
mov eax, ebx
jmp 0x1002074c
push eax
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x10106510
mov ecx, 0x100ce1d0
cmovbe eax, ecx
push eax
call fcn.100017f6
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001565
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x10111bdc
push eax
call fcn.10054af0
int3
Function at 0x10020be1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10020c67
cmp dword [ebp + 8], 0
je 0x10020c67
test edi, edi
jne 0x10020c0e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
lea eax, [ebx + ebx]
mov esi, 0x1f80000
cmp eax, 0x3f00000
lea eax, [ecx + edi*2]
cmovb esi, ebx
push esi
push 2
push eax
call fcn.10060b59
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x10020c44
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x10020c12
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x10020c63
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.10001981
add esp, 0xc
mov eax, esi
jmp 0x10020c07
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x10106510
mov ecx, 0x100ce1d0
cmovbe eax, ecx
push eax
call fcn.100017fc
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001565
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x10111bdc
push eax
call fcn.10054af0
int3

Function at 0x10020cc4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10020d4c
cmp dword [ebp + 8], 0
je 0x10020d4c
test edi, edi
jne 0x10020cf1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0xfc0000
shl eax, 2
cmp eax, 0x3f00000
lea eax, [ecx + edi*4]
cmovb esi, ebx
push esi
push 4
push eax
call fcn.10060b59
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x10020d29
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x10020cf5
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x10020d48
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.10001981
add esp, 0xc
mov eax, esi
jmp 0x10020cea
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x10106510
mov ecx, 0x100ce1d0
cmovbe eax, ecx
push eax
call fcn.10001808
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001565
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x10111bdc
push eax
call fcn.10054af0
int3