joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a49c1
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
push 0
mov esi, ecx
mov eax, dword [esi + 0xbc]
push 0x132f
push dword [esi + 0x18]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [esi + 0xb0]
mov edi, eax
mov eax, dword [ebp - 4]
cmp edi, eax
je 0x100a4a91
test edi, edi
jl 0x100a4a91
cmp edi, dword [esi + 0xb8]
jge 0x100a4a91
mov eax, dword [ebx + eax*4]
mov eax, dword [eax]
test eax, eax
je 0x100a4a20
push 0
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0xbc], edi
mov eax, dword [ebx + edi*4]
mov eax, dword [eax]
test eax, eax
je 0x100a4a3a
push 5
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [esi + 0x18]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, ebx
je 0x100a4a4e
push ebx
call dword [sym.imp.USER32.dll_SetFocus]
push 0x100cff90
lea ecx, [ebp - 4]
call fcn.100501eb
push dword [esi + 0x90]
lea ecx, [ebp - 4]
call fcn.1004618f
push str..Select
lea ecx, [ebp - 4]
call fcn.1004618f
push dword [ebp - 4]
inc edi
push edi
push dword [esi + 0x94]
call fcn.1004884d
add esp, 0xc
lea ecx, [ebp - 4]
call fcn.1003f96c
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100a6ac8
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0xfffffffffffffff0
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x100a6af3
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x18]
call edi
push 5
push dword [esi + 0x18]
call edi
pop edi
pop esi
ret
Function at 0x100b07e9
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, 0x2713
xor ebx, ebx
cmp dword [ebp + 8], edi
mov esi, ecx
jne 0x100b089d
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x100b087e
mov al, byte [esi + 0x79]
cmp al, bl
jle 0x100b085f
mov byte [esi + 0x79], bl
cmp byte [esi + 0x78], bl
jle 0x100b0993
push 1
push ebx
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x100b0993
dec al
cmp al, 0x9c
mov byte [esi + 0x79], al
jge 0x100b0993
push edi
push dword [esi + 0x18]
mov byte [esi + 0x79], bl
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x100b0993
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
jns 0x100b0993
cmp byte [esi + 0x79], bl
jg 0x100b0993
mov byte [esi + 0x79], 1
jmp 0x100b0845
mov edi, 0x2711
cmp dword [ebp + 8], edi
jne 0x100b0993
cmp byte [esi + 0x6c], bl
jle 0x100b0993
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x100b0956
push edi
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_KillTimer]
cmp word [esi + 0x6e], bx
mov byte [esi + 0x6c], bl
jl 0x100b0927
mov al, byte [esi + 0x78]
cmp al, bl
mov word [esi + 0x6e], bx
jle 0x100b0912
mov cl, byte [esi + 0x70]
and cl, 2
mov byte [esi + 0x71], cl
cmp byte [esi + 0x6d], bl
jne 0x100b091b
cmp al, bl
jle 0x100b0927
push 1
push ebx
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_InvalidateRect]
push ebx
push ebx
push 0x2a3
mov dword [0x100e3eb8], ebx
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 0x54]
cmp eax, dword [0x100e1854]
jne 0x100b0993
push 1
push dword [esi + 0x18]
call fcn.100b05c4
pop ecx
pop ecx
jmp 0x100b0993
mov al, byte [0x100e1859]
cmp al, byte [esi + 0x6c]
jne 0x100b0969
push dword [esi + 0x18]
call fcn.100a7e5b
pop ecx
mov al, byte [esi + 0x6c]
cmp al, byte [0x100e1858]
jg 0x100b0979
inc al
mov byte [esi + 0x6c], al
mov al, byte [0x100e1858]
cmp al, byte [esi + 0x6c]
jne 0x100b0993
push ebx
push ebx
push 0x2a1
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp byte [esi + 0x80], bl
jge 0x100b09ac
mov eax, dword [esi]
push ebx
push dword [ebp + 8]
push 0x113
push dword [esi + 0x18]
call dword [eax + 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100b3696
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
and eax, 0xffdf
cmp ax, 0x41
je 0x100b36b4
cmp ax, 0x42
je 0x100b36b4
push 0xfffffffffffffffe
pop eax
leave
ret
and word [ebp - 4], 0
mov word [ebp - 8], ax
lea eax, [ebp - 8]
push eax
mov word [ebp - 6], 0x3a
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
cmp eax, 2
setne cl
mov eax, ecx
leave
ret

Function at 0x100b3848
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop ebp
ret
Function at 0x100b38d0
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x100c5738
call fcn.100b707c
sub esp, 0x26c
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, eax
xor edi, edi
and esi, 1
and eax, 0xf0
cmp word [ebx], di
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], eax
jne 0x100b390d
mov eax, esi
jmp 0x100b3997
push ebx
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], esi
mov dword [ebp + 8], edi
mov dword [ebp - 0x274], edi
mov ecx, 0x93
xor eax, eax
lea edi, [ebp - 0x270]
rep stosd dword es:[edi], eax
xor edi, edi
mov dword [ebp + 0xc], edi
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp + 8]
push ebx
push eax
mov byte [ebp - 4], 2
call fcn.100b37d1
add esp, 0xc
cmp dword [ebp + 8], edi
jne 0x100b3a95
cmp dword [ebp - 0x24], edi
mov esi, dword [ebp - 0x1c]
je 0x100b39a6
push ebx
mov word [ebx + esi*2], 0x5c
mov word [ebx + esi*2 + 2], di
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, edi
mov dword [ebp - 0x18], eax
mov word [ebx + esi*2], di
je 0x100b39a6
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.1003f96c
lea ecx, [ebp + 8]
call fcn.10002d8b
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
cmp esi, 2
jl 0x100b3a74
add esi, esi
cmp word [esi + ebx - 2], 0x3a
je 0x100b39d9
cmp word [ebx], 0x5c
jne 0x100b3a74
cmp word [ebx + 2], 0x5c
jne 0x100b3a74
cmp word [ebx + 4], 0x3f
jne 0x100b3a74
push ebx
lea ecx, [ebp + 0xc]
call fcn.100502c8
mov edi, dword [ebp - 0x1c]
lea eax, [edi + 8]
push eax
lea ecx, [ebp + 0xc]
call fcn.10046168
mov ebx, dword [ebp + 0xc]
or dword [ebp - 0x14], 0x10
mov word [esi + ebx], 0x5c
mov eax, dword [ebp + 0xc]
mov word [esi + eax + 2], 0x2a
mov eax, dword [ebp + 0xc]
and word [eax + edi*2 + 4], 0
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp + 8]
push ebx
push eax
call fcn.100b37d1
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x100b3a92
mov eax, dword [ebp + 0xc]
mov word [esi + eax + 2], 0x2a
mov eax, dword [ebp + 0xc]
mov word [eax + edi*2 + 4], 0x2e
mov eax, dword [ebp + 0xc]
mov word [esi + eax + 2], 0x2a
mov eax, dword [ebp + 0xc]
and word [eax + edi*2 + 6], 0
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp + 8]
push ebx
push eax
call fcn.100b37d1
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x100b3a92
mov eax, dword [ebp + 0xc]
and word [esi + eax], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x274]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x100b3980
mov esi, dword [ebp - 0x14]
xor edi, edi
inc edi
cmp esi, edi
jne 0x100b3ac9
mov eax, dword [ebp - 0x274]
shr eax, 4
and eax, edi
mov dword [ebp - 0x18], eax
jne 0x100b3980
lea eax, [ebp - 0x274]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100b3a9c
jmp 0x100b3980
mov dword [ebp - 0x18], edi
jmp 0x100b3980
Function at 0x100b70fd
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x100b71ed
mov eax, 0x94
call fcn.100b44d0
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x100b7262
mov ecx, dword [esi + 0x10]
mov dword [0x100e3f9c], ecx
mov eax, dword [esi + 4]
mov dword [0x100e3fa8], eax
mov edx, dword [esi + 8]
mov dword [0x100e3fac], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x100e3fa0], esi
je 0x100b7168
or esi, 0x8000
mov dword [0x100e3fa0], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x100e3fa4], eax
call fcn.100b9a67
test eax, eax
pop ecx
je 0x100b7262
call fcn.100b8fad
test eax, eax
jne 0x100b7195
call fcn.100b9ab8
jmp 0x100b7262
call fcn.100bfd20
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x100e5854], eax
call fcn.100bfbfe
mov dword [0x100e3f88], eax
call fcn.100bf6df
test eax, eax
jl 0x100b71e6
call fcn.100bfb5c
test eax, eax
jl 0x100b71e1
call fcn.100bf929
test eax, eax
jl 0x100b71e1
push 0
call fcn.100b75a1
test eax, eax
pop ecx
jne 0x100b71e1
inc dword [0x100e3f84]
jmp 0x100b7273
call fcn.100bf8dd
call fcn.100b8d96
jmp 0x100b718b
test eax, eax
jne 0x100b721d
cmp dword [0x100e3f84], eax
jle 0x100b7262
dec dword [0x100e3f84]
cmp dword [0x100e3fd8], eax
jne 0x100b720c
call fcn.100b76df
call fcn.100bf8dd
call fcn.100b8d96
call fcn.100b9ab8
jmp 0x100b7273
cmp eax, 2
jne 0x100b7266
push 0x8c
push 1
call fcn.100bf608
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x100b7262
push esi
push dword [0x100e1e18]
call dword [0x100e3ff4]
test eax, eax
push esi
je 0x100b725c
call fcn.100b8db3
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x100b7273
call fcn.100b51bf
pop ecx
xor eax, eax
jmp 0x100b7276
cmp eax, 3
jne 0x100b7273
push 0
call fcn.100b8f7e
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc

Function at 0x100b760b
Capabilities:
Terminate process

Disassembly:
push 8
push 0x100d4f28
call fcn.100b4e40
push 8
call fcn.100b9c8a
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x100e3fdc], esi
jne 0x100b763f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x100e3fd8], esi
mov al, byte [ebp + 0x10]
mov byte [0x100e3fd4], al
cmp dword [ebp + 0xc], edi
jne 0x100b7689
cmp dword [0x100e584c], edi
je 0x100b7679
mov eax, dword [0x100e5848]
sub eax, 4
mov dword [0x100e5848], eax
cmp eax, dword [0x100e584c]
jb 0x100b7679
mov eax, dword [eax]
cmp eax, edi
je 0x100b765a
call eax
jmp 0x100b765a
push 0x100e10e8
mov eax, 0x100e10e0
call fcn.100b7589
pop ecx
push 0x100e10f4
mov eax, 0x100e10ec
call fcn.100b7589
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x100b76ba
cmp dword [ebp + 0x10], edi
jne 0x100b76c8
mov dword [0x100e3fdc], esi
push dword [ebp + 8]
call fcn.100b7547
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x100b76c7
push 8
call fcn.100b9bd5
pop ecx
ret
call fcn.100b4e7b
ret
Function at 0x100b82f7
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x100e235c]
xor ecx, ecx
xor eax, ebp
cmp dword [ebp + 0x3b4], ecx
push edi
mov edi, dword [ebp + 0x3b0]
mov dword [ebp + 0x3a0], eax
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], ecx
jne 0x100b8333
xor eax, eax
jmp 0x100b849d
mov eax, dword [ebp + 0x3ac]
push ebx
mov ebx, dword [ebp + 0x3ac]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x100e4700]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x100b8371
push 2
push ecx
push ecx
push dword [ebp + 0x3ac]
call fcn.100c0504
add esp, 0x10
xor ecx, ecx
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x100b840b
cmp dword [ebp + 0x3b4], ecx
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x68], ecx
jbe 0x100b846e
jmp 0x100b8395
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x64]
cmp ecx, dword [ebp + 0x3b4]
jae 0x100b83d0
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x100b83c1
inc dword [ebp - 0x78]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x6c]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 0x400
jl 0x100b83a1
mov edi, eax
lea eax, [ebp - 0x64]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100b842f
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x100b8438
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x7c]
cmp eax, dword [ebp + 0x3b4]
jb 0x100b8393
jmp 0x100b8438
push ecx
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b4]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100b842f
mov eax, dword [ebp - 0x80]
and dword [ebp - 0x68], 0
mov dword [ebp - 0x74], eax
jmp 0x100b8438
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x74]
test eax, eax
jne 0x100b8498
cmp dword [ebp - 0x68], eax
je 0x100b846b
push 5
pop esi
cmp dword [ebp - 0x68], esi
jne 0x100b8460
call fcn.100b8272
mov dword [eax], 9
call fcn.100b827b
mov dword [eax], esi
jmp 0x100b8493
push dword [ebp - 0x68]
call fcn.100b8284
pop ecx
jmp 0x100b8493
mov edi, dword [ebp - 0x7c]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x100b8480
cmp byte [edi], 0x1a
jne 0x100b8480
xor eax, eax
jmp 0x100b849b
call fcn.100b8272
mov dword [eax], 0x1c
call fcn.100b827b
and dword [eax], 0
or eax, 0xffffffff
jmp 0x100b849b
sub eax, dword [ebp - 0x78]
pop esi
pop ebx
mov ecx, dword [ebp + 0x3a0]
xor ecx, ebp
pop edi
call fcn.100c045b
add ebp, 0x3a4
leave
ret
Function at 0x100b9711
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.100b44d0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100b97ac
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x100e3f9c]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x100b97ac
cmp eax, 1
je 0x100b97cd
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100b97ac
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x100b9779
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x100b97a8
xor eax, eax
inc eax
jmp 0x100b97ec
cmp edi, eax
jae 0x100b97b0
xor eax, eax
jmp 0x100b97ec
cmp eax, esi
jae 0x100b97b7
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x100e3f9c]
jmp 0x100b97d0
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100bff27
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x100e235c]
mov ecx, dword [ebp + 0x98]
push ebx
xor eax, ebp
push esi
mov dword [ebp + 0x8c], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x100e2420]
je 0x100bff5e
inc eax
cmp eax, 0x13
jb 0x100bff4f
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x100e2420]
jne 0x100c0081
mov eax, dword [0x100e3f90]
cmp eax, 1
je 0x100c005c
cmp eax, edx
jne 0x100bff8e
cmp dword [0x100e3f94], 1
je 0x100c005c
cmp ecx, 0xfc
je 0x100c0081
push 0x104
lea eax, [ebp - 0x7c]
push eax
push edx
mov byte [ebp + 0x88], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100bffc4
lea eax, [ebp - 0x7c]
push str._program_name_unknown_
push eax
call fcn.100b4240
pop ecx
pop ecx
lea edi, [ebp - 0x7c]
mov eax, edi
push eax
call fcn.100b8560
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x100bfff8
mov eax, edi
push eax
call fcn.100b8560
mov edi, eax
lea eax, [ebp - 0x7c]
sub eax, 0x3b
push 3
add edi, eax
push 0x100db2b8
push edi
call fcn.100b6a80
add esp, 0x10
push edi
call fcn.100b8560
push dword [esi + 0x100e2424]
mov ebx, eax
call fcn.100b8560
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.100b44d0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.100b4240
push edi
push ebx
call fcn.100b4250
push 0x100db298
push ebx
call fcn.100b4250
push dword [esi + 0x100e2424]
push ebx
call fcn.100b4250
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.100c3153
add esp, 0x2c
jmp 0x100c0081
push edx
lea eax, [ebp - 0x80]
push eax
lea esi, [esi + 0x100e2424]
push dword [esi]
call fcn.100b8560
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8c]
xor ecx, ebp
call fcn.100c045b
add ebp, 0x90
leave
ret
Function at 0x100c3153
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x100e4428], ebx
push esi
push edi
jne 0x100c31d3
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x100c320e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x100e4428], eax
je 0x100c320e
push 0x100dcd98
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x100e442c], eax
call esi
cmp dword [0x100e3f9c], 2
mov dword [0x100e4430], eax
jne 0x100c31d3
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x100e4438], eax
je 0x100c31d3
push 0x100dcd50
push edi
call esi
mov dword [0x100e4434], eax
mov eax, dword [0x100e4434]
test eax, eax
je 0x100c3218
call eax
test eax, eax
je 0x100c31ff
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x100e4438]
test eax, eax
je 0x100c31ff
test byte [ebp - 8], 1
jne 0x100c3218
cmp dword [0x100e3fa8], 4
jb 0x100c3212
or byte [ebp + 0x12], 0x20
jmp 0x100c3237
xor eax, eax
jmp 0x100c3247
or byte [ebp + 0x12], 4
jmp 0x100c3237
mov eax, dword [0x100e442c]
test eax, eax
je 0x100c3237
call eax
mov ebx, eax
test ebx, ebx
je 0x100c3237
mov eax, dword [0x100e4430]
test eax, eax
je 0x100c3237
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x100e4428]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100c46cc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x100c48a2
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x100e4700]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x100c48a2
test cl, 0x48
je 0x100c4737
cmp byte [eax + 5], 0xa
je 0x100c4737
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100c4789
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x100c4771
call fcn.100b8272
mov dword [eax], 9
call fcn.100b827b
mov dword [eax], esi
jmp 0x100c4781
cmp eax, 0x6d
je 0x100c48a2
push eax
call fcn.100b8284
pop ecx
or eax, 0xffffffff
jmp 0x100c48a4
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x100c489d
test eax, eax
je 0x100c47b0
cmp byte [ebx], 0xa
jne 0x100c47b0
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x100c47b9
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x100c4897
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x100c4887
cmp al, 0xd
je 0x100c47eb
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x100c4879
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x100c4805
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x100c4800
add dword [ebp + 0x10], 2
jmp 0x100c4859
mov dword [ebp + 0x10], eax
jmp 0x100c4875
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100c482d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100c4875
cmp dword [ebp - 0xc], 0
je 0x100c4875
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x100c484e
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x100c4859
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x100c4878
cmp ebx, dword [ebp + 0xc]
jne 0x100c485e
cmp byte [ebp - 1], 0xa
jne 0x100c485e
mov byte [ebx], 0xa
jmp 0x100c4878
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.100c0504
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x100c4879
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x100c47cf
jmp 0x100c4897
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x100c4897
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x100c48a4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret