joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006e10
Capabilities:
Get networking parameters

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
lea eax, [ebp - 4]
push eax
push 0
xor eax, eax
call dword [sym.imp.iphlpapi.dll_GetNetworkParams]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x10006e67
push 0
push 0x4013dc7
push 6
call fcn.10016e9e
add esp, 0xc
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
push 0x40
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x10006e98
push 0x3c
push 0x4013dc7
push 6
call fcn.10016e9e
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], esp
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.iphlpapi.dll_GetNetworkParams]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x10006ecb
push 0x79
push 0x4013dc7
push 6
call fcn.10016e9e
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10006f54
push 0x80000301
push 0
push 0x84
push 0x80000301
push 0
push dword [ebp - 8]
push 2
mov ebx, 0x910
call fcn.1001a1b0
add esp, 0x1c
mov dword [ebp - 0x14], eax
push SysStringLen
push 0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x10006f16
mov eax, 0x100352ee
push eax
push 1
mov ebx, 0x168
call fcn.1001b260
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x10006f3c
push ebx
call fcn.10016e98
add esp, 4
mov eax, dword [ebp - 0x18]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10006f50
push ebx
call fcn.10016e98
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x10006f80
push 0x123
push 0x4013dc7
push 6
call fcn.10016e9e
add esp, 0xc
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10006f9c
push eax
mov ebx, eax
call fcn.100010a5
inc eax
push eax
call fcn.10016e8c
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10006fa1
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10006fb2
push ebx
call fcn.10016e98
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x1000be9b
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
nop
nop
cmp dword [ebp - 4], esp
je 0x1000beda
push 0x12
push 0x4013727
push 6
call fcn.10016e9e
add esp, 0xc
jmp 0x1000bedf
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10017910
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1015bba8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x108], ecx
lea eax, [ecx - 1]
cmp eax, 0xa
ja 0x1001793d
mov edx, dword [ecx*4 + 0x1015b96c]
lea eax, [ebp - 0x108]
mov eax, dword [eax - 4]
test eax, eax
je 0x1001797b
push esi
mov esi, 0xc483
cmp si, word [eax]
pop esi
jne 0x1001797b
cmp byte [eax + 2], 0xc
jl 0x1001797b
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push dword [ebp + 0xc]
push edx
push ecx
push 0x1002d454
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
jmp 0x10017992
push edx
push ecx
lea eax, [ebp - 0x104]
push str.program_internal_error_number_is__d.__r_n_s_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [0x1015c490]
test eax, eax
je 0x100179cb
cmp dword [0x1015c4a4], 0
jne 0x100179cb
lea ecx, [ebp - 0x104]
mov dword [0x1015c4a4], 1
push ecx
push dword [ebp - 0x108]
call eax
mov dword [0x1015c4a4], 0
test eax, eax
jne 0x100179e1
push 0x10
push str.error
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.10017570
cmp dword [0x1015c488], 0
jne 0x100179f7
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0
mov ebp, dword [0x1015c48c]
mov esp, dword [0x1015c488]
sub esp, 4
ret
Function at 0x10017a20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push dword [ebp + 0xc]
call fcn.1001bda0
mov esi, dword [ebp + 0x18]
mov edi, eax
push esi
mov dword [ebp - 8], edi
xor ebx, ebx
call dword [0x1015bba0]
add esp, 8
test edi, edi
je 0x10017b49
test eax, eax
je 0x10017b49
inc eax
push eax
call fcn.1001c9af
mov edx, eax
mov dword [ebp - 0x10], eax
add esp, 4
sub edx, esi
mov cl, byte [esi]
lea esi, [esi + 1]
mov byte [edx + esi - 1], cl
test cl, cl
jne 0x10017a66
push 0x5c
push eax
call fcn.1001dcd0
mov edi, eax
add esp, 8
test edi, edi
je 0x10017a87
mov byte [edi], bl
inc edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10017b3a
push 0x400
mov dword [ebp - 4], 0x400
mov dword [ebp - 8], 1
call fcn.1001c9af
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10017b08
cmp eax, 0xea
jne 0x10017b28
push esi
call fcn.1001c9b8
push dword [ebp - 4]
call fcn.1001c9af
add esp, 8
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10017ad5
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x10017b15
cmp eax, 2
jne 0x10017b28
push esi
call dword [0x1015bba0]
push eax
push esi
call fcn.1001bd60
add esp, 0xc
mov ebx, eax
push esi
call fcn.1001c9b8
add esp, 4
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x10]
call fcn.1001c9b8
add esp, 4
test ebx, ebx
jne 0x10017b6e
cmp dword [ebp + 0x2c], 0
je 0x10017b6e
mov esi, dword [ebp + 0x24]
test esi, esi
je 0x10017b6e
push esi
call dword [0x1015bba0]
push eax
push esi
call fcn.1001bd60
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10017d50
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10017dbc
push esi
push edi
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [esi + 8]
push ecx
call fcn.10017780
add esp, 4
mov edi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
lea ecx, [edi + 8]
mov dword [edi], 1
push ecx
push ebx
mov dword [edi + 4], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100199d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp ecx, 0xffffffff
je 0x10019a5f
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, 1
mov dword [ebp - 8], 1
cmp ebx, esi
jle 0x10019a4f
push edi
lea edi, [ebp + 0x18]
mov eax, dword [edi]
lea edx, [ebp - 0xc]
push 0
push edx
push dword [eax + 4]
add eax, 8
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
test eax, eax
je 0x10019a47
inc esi
add edi, 0xc
cmp esi, ebx
jl 0x10019a11
pop edi
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 8], 0
pop edi
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1001b570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, 1
lea eax, [ecx - 1]
cmp ecx, edi
jle 0x1001b63b
cmp eax, 8
jb 0x1001b628
and eax, 0x80000007
jns 0x1001b5a0
dec eax
or eax, 0xfffffff8
inc eax
mov edx, ecx
xorps xmm5, xmm5
sub edx, eax
xorps xmm4, xmm4
lea eax, [ebp + 0x30]
nop dword [eax]
movd xmm2, dword [eax + 0xc]
lea eax, [eax + 0x60]
movd xmm0, dword [eax - 0x60]
add edi, 8
movd xmm1, dword [eax - 0x6c]
movd xmm3, dword [eax - 0x78]
punpckldq xmm3, xmm0
movd xmm0, dword [eax - 0x30]
punpckldq xmm1, xmm2
movd xmm2, dword [eax - 0x24]
punpckldq xmm3, xmm1
movd xmm1, dword [eax - 0x3c]
pxor xmm5, xmm3
movd xmm3, dword [eax - 0x48]
punpckldq xmm3, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
pxor xmm4, xmm3
cmp edi, edx
jl 0x1001b5b0
pxor xmm4, xmm5
movaps xmm0, xmm4
psrldq xmm0, 8
pxor xmm4, xmm0
movups xmm0, xmm4
psrldq xmm0, 4
pxor xmm4, xmm0
movd edx, xmm4
xor esi, edx
cmp edi, ecx
jge 0x1001b63b
lea eax, [edi + edi*2]
sub ecx, edi
lea eax, [ebp + eax*4 + 0xc]
xor esi, dword [eax]
lea eax, [eax + 0xc]
sub ecx, 1
jne 0x1001b631
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x40324c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40325b
pop dword [ebp - 0x40]
mov eax, 0x40325b
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x4ed74f2d
sub dword [ebp - 0x50], 0x8509e2
mov dword [ebp - 0x4c], 0x94ae69e3
add dword [ebp - 0x4c], 0x9d84e262
mov dword [ebp - 0x48], 0xa2507287
add dword [ebp - 0x48], 0xa9fbd1a7
mov dword [ebp - 0x44], 0x90efe414
add dword [ebp - 0x44], 0x6f101bec
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x20579dcd
sub dword [ebp - 0x50], 0xabe53477
mov dword [ebp - 0x4c], 0x1349804e
add dword [ebp - 0x4c], 0x2e22e127
mov dword [ebp - 0x48], 0x8e3ca7ed
add dword [ebp - 0x48], 0xd532c47f
mov dword [ebp - 0x44], 0x115afe33
sub dword [ebp - 0x44], 0x115afe33
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x5765d6fc
sub eax, 0x57255680
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x35a14
push 0
call eax
mov ecx, 0x9090b420
add ecx, 0x6f6f8e45
xor edi, edi
add edi, eax
mov ebx, 0xa38bb0cd
sub ebx, 0xa3469ccd
add ebx, dword [ebp - 0x40]
mov esi, 0xb84886e9
add esi, 0x72f5cf99
xor dword [ebp - 0x1c], 0x1cc06af8
mov edx, dword [ebx]
xor dword [ebp - 0x30], ecx
xor edx, esi
mov dword [edi], edx
sub dword [ebp - 0xc], 0x4dc2b823
add edi, 0xe6b08a45
add edi, 0x194f75bf
add ebx, 0xce7aa1fd
sub ebx, 0xce7aa1f9
loop 0x403375
add eax, 0x27b1104b
sub eax, 0x27b013e4
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x48aa6944
sub ecx, 0x486a6944
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x100de49f
Capabilities:
Create thread

Disassembly:
mov edi, edi
push esi
push 0x1029b4f0
mov esi, ecx
call dword [sym.imp.dbghelp.dll_ImagehlpApiVersionEx]
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [0x102b2a70], edx
mov dword [0x102b2a74], eax
cmp ax, word [0x1029b4f4]
jae 0x100de4f0
test byte [0x1029b530], 1
push 0x100605e8
jne 0x100de4ea
call fcn.100d3aab
pop ecx
mov ecx, esi
call fcn.1017a65c
mov eax, 0x80004005
pop esi
ret
call fcn.100d3aca
pop ecx
call fcn.100f8ae7
cmp dword [0x102b2aac], 0
jne 0x100de53b
push 0x100601b0
push 0x1005a41c
call fcn.100d3a67
pop ecx
pop ecx
mov dword [0x102b2aac], 1
call fcn.101f6b95
xor eax, eax
push eax
push eax
push eax
push 0x100f94a0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100de53b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
ret
Function at 0x100eced4
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x10285008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
lea eax, [ebp - 0x48]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 0x40
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x144], esi
push dword [ebp + 0xc]
mov dword [ebp - 0x148], edi
push edi
call fcn.100bd29f
test eax, eax
jne 0x100ecfc1
mov eax, 0x5a4d
cmp word [ebp - 0x48], ax
je 0x100ecf2f
mov eax, 0x80070057
jmp 0x100ecfc1
push 0xf8
lea eax, [ebp - 0x140]
mov ecx, esi
push eax
mov eax, dword [ebp - 0xc]
cdq
add eax, dword [ebp + 0xc]
adc edx, dword [ebp + 0x10]
push edx
push eax
push edi
call fcn.100bd29f
test eax, eax
jne 0x100ecfc1
cmp dword [ebp - 0x140], 0x4550
jne 0x100ecf25
movzx eax, word [ebp - 0x128]
cmp eax, 0x10b
je 0x100ecfb1
cmp eax, 0x20b
jne 0x100ecf25
push 0x3e
pop ecx
push 0x10
lea eax, [ebx + 0xf8]
mov edi, ebx
push eax
mov eax, dword [ebp - 0xc]
lea esi, [ebp - 0x140]
cdq
add eax, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
adc edx, dword [ebp + 0x10]
add eax, 0xf8
mov ecx, dword [ebp - 0x144]
adc edx, 0
push edx
push eax
push dword [ebp - 0x148]
call fcn.100bd29f
jmp 0x100ecfc1
push ecx
mov edx, ebx
lea ecx, [ebp - 0x140]
call fcn.1020cf8a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10236010
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100f699b
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ecx]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
and dword [esi], 0
mov dword [edi], eax
mov ax, word [ecx + 4]
mov word [edi + 4], ax
mov ax, word [ecx + 6]
mov word [edi + 6], ax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [edi]
add eax, 0xffffced0
cmp eax, 0x26
ja case.0x100f69db.12595
movzx eax, byte [eax + 0x100f6b0f]
jmp dword [eax*4 + 0x100f6ae3]
add edi, 0x10
lea esi, [ecx + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp case.0x100f69db.12595
mov dword [esi], 0x2cc
jmp case.0x100f69db.12595
mov eax, dword [ecx + 0xc]
mov dword [edi + 0x10], eax
mov eax, dword [ecx + 0x10]
mov dword [edi + 0x14], eax
mov eax, dword [edi + 0x10]
shl eax, 2
mov dword [esi], eax
jmp case.0x100f69db.12595
mov eax, dword [ecx + 0xc]
cdq
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
mov eax, dword [ecx + 0x10]
mov dword [edi + 0x18], eax
mov eax, dword [ecx + 0x14]
mov dword [edi + 0x1c], eax
cmp dword [ecx + 8], 0
jl case.0x100f69db.12595
jmp 0x100f6a0d
mov eax, dword [ecx + 0xc]
cdq
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
mov eax, dword [ecx + 0x10]
mov dword [edi + 0x18], eax
mov eax, dword [ecx + 0x14]
mov dword [edi + 0x1c], eax
jmp case.0x100f69db.12595
mov eax, dword [ecx + 0xc]
cdq
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
mov eax, dword [ecx + 0x10]
mov dword [edi + 0x18], eax
jmp case.0x100f69db.12595
mov eax, dword [ecx + 0x10]
cdq
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
mov eax, dword [ecx + 0xc]
jmp 0x100f6a43
mov eax, dword [ecx + 0xc]
mov dword [edi + 0x10], eax
mov eax, dword [ecx + 0x10]
mov dword [edi + 0x14], eax
mov eax, dword [ecx + 0x14]
mov dword [edi + 0x18], eax
mov eax, dword [ecx + 0x18]
mov dword [edi + 0x1c], eax
mov eax, dword [ecx + 0x1c]
cdq
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], edx
mov eax, dword [ecx + 0x20]
mov dword [edi + 0x28], eax
jmp case.0x100f69db.12595
mov eax, dword [ecx + 0xc]
cdq
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
mov eax, dword [ecx + 0x10]
mov dword [edi + 0x18], eax
mov eax, dword [ecx + 0x14]
mov dword [edi + 0x1c], eax
mov eax, dword [ecx + 0x18]
mov dword [edi + 0x20], eax
mov eax, dword [ecx + 0x1c]
mov dword [edi + 0x24], eax
mov eax, dword [ecx + 0x20]
mov dword [edi + 0x28], eax
mov eax, dword [ecx + 0x24]
mov dword [edi + 0x2c], eax
jmp case.0x100f69db.12595
lea esi, [ecx + 0xc]
add edi, 0x10
push 6
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x38
pop eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x100f8a19
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x10285008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x102d2cd8]
xor eax, eax
push esi
push edi
push 9
pop ecx
mov esi, 0x11c
lea edi, [ebp - 0x144]
push esi
push eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x120]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x144]
mov esi, dword [0x102b6b38]
mov ecx, esi
push eax
push 0x29
push ebx
call dword [0x102dc578]
call esi
lea eax, [ebp - 0x120]
push eax
call dword [0x102a9cac]
test eax, eax
je 0x100f8ad1
push dword [ebp - 0x11c]
mov esi, dword [0x102b6b38]
mov ecx, esi
push 0x18a
push ebx
call dword [0x102dc578]
call esi
push dword [ebp - 0x118]
mov esi, dword [0x102b6b38]
mov ecx, esi
push 0x18b
push ebx
call dword [0x102dc578]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10236010
mov esp, ebp
pop ebp
ret
Function at 0x10120275
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x10285008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
push 0x10076e58
inc ebx
call dword [sym.imp.msvcrt.dll_getenv]
pop ecx
test eax, eax
je 0x101202b7
push eax
call dword [sym.imp.msvcrt.dll_atoi]
sub eax, dword [edi + 0xf18]
neg eax
pop ecx
sbb eax, eax
inc eax
jmp 0x10120346
mov eax, dword [edi + 0xf10]
and dword [ebp - 0x54], 0
cmp dword [eax + 0x18], 0
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x58], ecx
jbe 0x10120344
lea eax, [edi + 0xc20]
push 0xc
lea edx, [ebp - 0x10]
push edx
push 0
push ecx
mov ecx, eax
call fcn.10128bce
test eax, eax
jne 0x1012035b
mov esi, dword [edi]
lea eax, [ebp - 0x5c]
push eax
push 0x40
lea eax, [ebp - 0x50]
mov ecx, dword [esi + 0x50]
push eax
push 0
push dword [ebp - 0x10]
push dword [edi + 0x34]
call dword [0x102dc578]
mov ecx, edi
call dword [esi + 0x50]
test eax, eax
jne 0x10120357
cmp dword [ebp - 0x5c], 0x40
jne 0x10120357
mov eax, 0x5a4d
cmp word [ebp - 0x50], ax
jne 0x10120357
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x58]
add eax, 0xc
mov esi, dword [ebp - 0x54]
add ecx, eax
mov eax, dword [edi + 0xf10]
inc esi
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], esi
cmp esi, dword [eax + 0x18]
lea eax, [edi + 0xc20]
jb 0x101202d3
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10236010
mov esp, ebp
pop ebp
ret
xor ebx, ebx
jmp 0x10120344
xor eax, eax
jmp 0x10120346

Function at 0x1012a19e
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 4]
xor esi, esi
push esi
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1012a1e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1012a1d2
mov esi, 0x80004005
jmp 0x1012a1f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1012a1f5
movzx esi, si
or esi, 0x80070000
jmp 0x1012a1f3
cmp dword [ebp - 4], edi
je 0x1012a218
mov esi, 0x80070070
test esi, esi
je 0x1012a218
push ecx
push ecx
xor edx, edx
mov ecx, esi
call fcn.102107ba
push eax
mov ecx, esi
call fcn.10210755
push eax
push 0x1007a6f8
call fcn.100d3aab
add esp, 0xc
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x101670d3
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], edx
test dword [0x102a5b74], 0x200
mov esi, ecx
push edi
mov edi, ebx
mov dword [eax], ebx
je 0x10167100
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edi, eax
push ebx
push ebx
push 3
push ebx
push 7
push 0x80000000
push esi
call dword [0x102a9c60]
test dword [0x102a5b74], 0x200
mov esi, eax
je 0x10167128
push edi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
test esi, esi
je 0x1016714a
cmp esi, 0xffffffff
je 0x1016714a
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x1016715b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10167195
mov eax, 0x80004005
jmp 0x101671a7
push ebx
push ebx
push ebx
push 2
push ebx
push esi
call dword [0x102a9c5c]
mov edi, eax
test edi, edi
je 0x10167143
push ebx
push ebx
push ebx
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1016714a
mov eax, dword [ebp - 4]
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor eax, eax
jmp 0x101671a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101671a7
movzx eax, ax
or eax, 0x80070000
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x101712d8
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
xor edi, edi
cmp dword [esi + 0xd4], 0x10
jb 0x10171301
push 0x1008bf68
jmp 0x1017135f
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov edi, eax
test edi, edi
jne 0x10171320
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1008bfb8
jmp 0x1017133d
xor edi, edi
push edi
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x10171345
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1008c008
call fcn.100d3aab
pop ecx
jmp 0x10171364
push edi
push 0x1000
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.1026ae00
or eax, edx
je 0x10171367
push 0x1008c070
call fcn.100d3aab
pop ecx
jmp 0x101713ac
push edi
push 0x1000
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.1026ac40
mov edx, dword [esi + 0xd4]
mov ecx, dword [esi + edx*8 + 0x18]
mov dword [esi + edx*8 + 0x14], eax
cmp eax, ecx
jbe 0x1017138c
mov ecx, eax
mov dword [esi + edx*8 + 0x18], ecx
xor edi, edi
add dword [esi + 0xd8], eax
mov eax, dword [esi + 0xd4]
mov dword [esi + eax*4 + 0x94], ebx
inc dword [esi + 0xd4]
inc edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret