joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10063ce0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x100b9034]
mov edi, eax
add esp, 4
test edi, edi
jne 0x10063d07
pop edi
pop esi
pop ecx
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi + 8], eax
push ebp
cmp ebx, dword [esi + 0x10]
jbe 0x10063d4f
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [esp + 0x24]
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [esp + 0x20], ebx
jmp 0x10063d53
mov ebp, dword [esp + 0x1c]
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x28]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x10063db3
mov dword [esp + 0x10], eax
mov ebx, eax
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x24], al
lea eax, [esp + 0x24]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
dec ebx
jne 0x10063d74
mov ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0x10]
jae 0x10063de7
jmp 0x10063dc0
mov eax, dword [esi + 4]
push 1
push 0x100aca5d
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x100aca5e
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x10063dc0
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x10063f80
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 8
lea eax, [esp]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x10063fa5
mov eax, 0x1b
add esp, 8
ret
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x800c
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x10063fd5
push eax
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
add esp, 8
ret
push dword [esp + 0x14]
call fcn.10022d10
add esp, 4
push 0
push eax
push dword [esp + 0x18]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
lea ecx, [esp]
push ecx
push dword [esp + 0x10]
call fcn.10063f20
add esp, 8
xor eax, eax
add esp, 8
ret
Function at 0x10091df9
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100b9550]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1007c964
mov dword [ebp - 0x14], eax
cmp dword [0x100bc268], esi
jne 0x10091eec
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10091e79
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10091fcc
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10091fcc
push 0x100b3fc8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10091fcc
push eax
call ebx
push 0x100b3fd4
push edi
mov dword [0x100bc268], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100b3fe4
push edi
mov dword [0x100bc26c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100b3ff8
push edi
mov dword [0x100bc270], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x100bc278], eax
test eax, eax
je 0x10091ee9
push 0x100b4014
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x100bc274], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10091f11
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10091f04
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10091f26
push 4
pop eax
jmp 0x10091fce
cmp dword [ebp - 0x14], esi
je 0x10091f26
push dword [0x100bc268]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10091f0b
mov eax, dword [0x100bc274]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10091f84
cmp dword [0x100bc278], edi
je 0x10091f84
push eax
call ebx
push dword [0x100bc278]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10091f84
test eax, eax
je 0x10091f84
call ecx
test eax, eax
je 0x10091f79
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10091f79
test byte [ebp - 8], 1
jne 0x10091f84
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10091fb4
mov eax, dword [0x100bc26c]
cmp eax, edi
je 0x10091fb1
push eax
call ebx
test eax, eax
je 0x10091fb1
call eax
mov esi, eax
test esi, esi
je 0x10091fb1
mov eax, dword [0x100bc270]
cmp eax, edi
je 0x10091fb1
push eax
call ebx
test eax, eax
je 0x10091fb1
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x100bc268]
call ebx
test eax, eax
je 0x10091fcc
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10091fce
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100676f5
mov esp, ebp
pop ebp
ret
Function at 0x42211b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42215a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42215a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42215a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42215a
cmp dword [ecx + 0x74], 0xe
jbe 0x42215a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4347a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4347cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4347cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40601c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x406028
push 0x406024
push 0x406020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x406028]
push dword [0x406024]
push dword [0x406020]
mov dword [0x406014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x84], 0
call fcn.00401902
mov esi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, esi
or al, 0x40
push eax
lea eax, [0x404415]
lea edx, [fcn.00401974]
sub eax, edx
push eax
push fcn.00401974
call sub.KERNEL32.dll_VirtualProtect
cmp dword [ebp - 4], 0
je 0x401341
push esi
call fcn.004017e8
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.00401832
mov eax, esi
add eax, 0x1cc00
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x88]
mov ecx, esi
inc ecx
cdq
idiv ecx
push eax
lea edi, [0x4060e4]
mov eax, esi
lea ebx, [0x4060e4]
or bl, 1
mul ebx
mov dword [ebp - 0x8c], eax
mov ebx, eax
sub edi, eax
push edi
call fcn.00401974
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401902
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push edi
and dword [ebp - 0x118], 0
xor edi, edi
mov dword [ebp - 0x114], 0xa
mov byte [ebp - 0x104], 0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10e]
push eax
push 1
push 1
lea eax, [ebp - 0x104]
push eax
call sub.CRYPT32.DLL_CryptBinaryToStringA
call sub.KERNEL32.dll_GetLastError
push 0
push 0
call sub.SHLWAPI.DLL_PathAppendA
movsx edi, byte [ebp - 0x10e]
sub edi, 0x41
mov eax, edi
pop edi
leave
ret
Function at 0x1000c9fd
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.1000c9c0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1000ca98
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x1002e9a4]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x1000ca98
cmp eax, 1
je 0x1000cab9
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1000ca98
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x1000ca65
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x1000ca94
xor eax, eax
inc eax
jmp 0x1000cad8
cmp edi, eax
jae 0x1000ca9c
xor eax, eax
jmp 0x1000cad8
cmp eax, esi
jae 0x1000caa3
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x1002e9a4]
jmp 0x1000cabc
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000d644
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x1000d734
mov eax, 0x94
call fcn.1000c9c0
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1000d7a9
mov ecx, dword [esi + 0x10]
mov dword [0x1002e9a4], ecx
mov eax, dword [esi + 4]
mov dword [0x1002e9b0], eax
mov edx, dword [esi + 8]
mov dword [0x1002e9b4], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x1002e9a8], esi
je 0x1000d6af
or esi, 0x8000
mov dword [0x1002e9a8], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x1002e9ac], eax
call fcn.1000ea84
test eax, eax
pop ecx
je 0x1000d7a9
call fcn.100102c5
test eax, eax
jne 0x1000d6dc
call fcn.1000ead5
jmp 0x1000d7a9
call fcn.100119ca
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10030240], eax
call fcn.100118a8
mov dword [0x1002e980], eax
call fcn.10011389
test eax, eax
jl 0x1000d72d
call fcn.10011806
test eax, eax
jl 0x1000d728
call fcn.100115d3
test eax, eax
jl 0x1000d728
push 0
call fcn.1000e4dd
test eax, eax
pop ecx
jne 0x1000d728
inc dword [0x1002e97c]
jmp 0x1000d7ba
call fcn.10011587
call fcn.100100ae
jmp 0x1000d6d2
test eax, eax
jne 0x1000d764
cmp dword [0x1002e97c], eax
jle 0x1000d7a9
dec dword [0x1002e97c]
cmp dword [0x1002e9e0], eax
jne 0x1000d753
call fcn.1000e61b
call fcn.10011587
call fcn.100100ae
call fcn.1000ead5
jmp 0x1000d7ba
cmp eax, 2
jne 0x1000d7ad
push 0x8c
push 1
call fcn.1000e9af
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x1000d7a9
push esi
push dword [0x1002be64]
call dword [0x1002eb40]
test eax, eax
push esi
je 0x1000d7a3
call fcn.100100cb
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x1000d7ba
call fcn.1000c3c5
pop ecx
xor eax, eax
jmp 0x1000d7bd
cmp eax, 3
jne 0x1000d7ba
push 0
call fcn.10010296
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc

Function at 0x1000e547
Capabilities:
Terminate process

Disassembly:
push 8
push 0x100249b0
call fcn.1000e658
push 8
call fcn.1000eca7
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x1002e9e4], esi
jne 0x1000e57b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x1002e9e0], esi
mov al, byte [ebp + 0x10]
mov byte [0x1002e9dc], al
cmp dword [ebp + 0xc], edi
jne 0x1000e5c5
cmp dword [0x1003000c], edi
je 0x1000e5b5
mov eax, dword [0x10030008]
sub eax, 4
mov dword [0x10030008], eax
cmp eax, dword [0x1003000c]
jb 0x1000e5b5
mov eax, dword [eax]
cmp eax, edi
je 0x1000e596
call eax
jmp 0x1000e596
push 0x1002b080
mov eax, 0x1002b078
call fcn.1000e4c5
pop ecx
push 0x1002b08c
mov eax, 0x1002b084
call fcn.1000e4c5
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x1000e5f6
cmp dword [ebp + 0x10], edi
jne 0x1000e604
mov dword [0x1002e9e4], esi
push dword [ebp + 8]
call fcn.1000e483
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x1000e603
push 8
call fcn.1000ebf2
pop ecx
ret
call fcn.1000e693
ret
Function at 0x10011bd7
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x1002ba94]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x1002c0c8]
je 0x10011c0c
inc eax
cmp eax, 0x13
jb 0x10011bfd
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x1002c0c8]
jne 0x10011d32
mov eax, dword [0x1002e988]
cmp eax, 1
je 0x10011d0a
cmp eax, edx
jne 0x10011c3c
cmp dword [0x1002e98c], 1
je 0x10011d0a
cmp ecx, 0xfc
je 0x10011d32
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10011c72
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.10013880
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.1000cbf0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10011ca6
mov eax, edi
push eax
call fcn.1000cbf0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x100250c8
push edi
call fcn.10014280
add esp, 0x10
push edi
call fcn.1000cbf0
push dword [esi + 0x1002c0cc]
mov ebx, eax
call fcn.1000cbf0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.1000c9c0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.10013880
push edi
push ebx
call fcn.10013890
push 0x100250a8
push ebx
call fcn.10013890
push dword [esi + 0x1002c0cc]
push ebx
call fcn.10013890
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.10014a75
add esp, 0x2c
jmp 0x10011d32
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x1002c0cc]
push dword [esi]
call fcn.1000cbf0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.1000da98
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x10014508
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x1002ba94]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x10014539
xor eax, eax
jmp 0x100146c2
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x1002fee0]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x10014575
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.10015d50
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x10014650
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x1001468e
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x100145d9
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x100145ca
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x100145aa
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10014619
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x10014622
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x1001459b
jmp 0x10014624
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x100146bd
cmp dword [ebp - 0x6c], edi
je 0x1001468e
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x10014683
call fcn.1000e92a
mov dword [eax], 9
call fcn.1000e933
mov dword [eax], esi
jmp 0x100146b8
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10014678
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x10014624
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x10014624
push dword [ebp - 0x6c]
call fcn.1000e93c
pop ecx
jmp 0x100146b8
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x100146a6
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x100146a6
xor eax, eax
jmp 0x100146c0
call fcn.1000e92a
mov dword [eax], 0x1c
call fcn.1000e933
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x100146c0
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.1000da98
add ebp, 0x3a0
leave
ret
Function at 0x10014a75
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x1002ee28], ebx
push esi
push edi
jne 0x10014af5
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10014b30
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10025a64
push edi
call esi
test eax, eax
mov dword [0x1002ee28], eax
je 0x10014b30
push 0x10025a54
push edi
call esi
push 0x10025a40
push edi
mov dword [0x1002ee2c], eax
call esi
cmp dword [0x1002e9a4], 2
mov dword [0x1002ee30], eax
jne 0x10014af5
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x1002ee38], eax
je 0x10014af5
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x1002ee34], eax
mov eax, dword [0x1002ee34]
test eax, eax
je 0x10014b3a
call eax
test eax, eax
je 0x10014b21
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x1002ee38]
test eax, eax
je 0x10014b21
test byte [ebp - 8], 1
jne 0x10014b3a
cmp dword [0x1002e9b0], 4
jb 0x10014b34
or byte [ebp + 0x12], 0x20
jmp 0x10014b59
xor eax, eax
jmp 0x10014b69
or byte [ebp + 0x12], 4
jmp 0x10014b59
mov eax, dword [0x1002ee2c]
test eax, eax
je 0x10014b59
call eax
mov ebx, eax
test ebx, ebx
je 0x10014b59
mov eax, dword [0x1002ee30]
test eax, eax
je 0x10014b59
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x1002ee28]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10016851
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x10016a25
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x1002fee0]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x10016a25
test cl, 0x48
je 0x100168bc
cmp byte [eax + 5], 0xa
je 0x100168bc
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001690e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x100168f6
call fcn.1000e92a
mov dword [eax], 9
call fcn.1000e933
mov dword [eax], esi
jmp 0x10016906
cmp eax, 0x6d
je 0x10016a25
push eax
call fcn.1000e93c
pop ecx
or eax, 0xffffffff
jmp 0x10016a27
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x10016a20
test eax, eax
je 0x10016935
cmp byte [ebx], 0xa
jne 0x10016935
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x1001693e
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x10016a1a
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x10016a0a
cmp al, 0xd
je 0x10016970
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x100169fc
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x1001698a
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x10016985
add dword [ebp + 0x10], 2
jmp 0x100169de
mov dword [ebp + 0x10], eax
jmp 0x100169f8
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100169b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100169f8
cmp dword [ebp - 0xc], 0
je 0x100169f8
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x100169d3
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x100169de
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x100169fb
cmp ebx, dword [ebp + 0xc]
jne 0x100169e3
cmp byte [ebp - 1], 0xa
jne 0x100169e3
mov byte [ebx], 0xa
jmp 0x100169fb
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.100143e9
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x100169fc
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x10016954
jmp 0x10016a1a
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x10016a1a
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x10016a27
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret