joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100069c4
Capabilities:
Accept command line arguments
Delete file
Move file

Disassembly:
call fcn.1000269c
call fcn.10005360
mov eax, dword [0x10017a64]
push 1
mov dword [ebp + 0xc], eax
call fcn.100017d0
mov eax, dword [0x10020668]
neg eax
sbb eax, eax
and eax, 2
inc eax
inc eax
push eax
call fcn.10005ec4
push ebx
call fcn.10003b58
push 0x202
call fcn.10005260
cmp dword [0x1002066c], ebx
jne 0x10006a25
push ebx
push ebx
push 1
push 1
call fcn.10001e30
test eax, eax
jne 0x10006a2a
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
jmp 0x10006c6d
call fcn.100013a2
push 0x201
call fcn.10005260
push dword [ebp + 8]
call fcn.10005d04
push 0x1f7
call fcn.10005260
cmp dword [0x1002066c], ebx
jne 0x10006a83
cmp dword [ebp - 4], ebx
je 0x10006aa4
push 0x10017984
call fcn.10002a94
test eax, eax
jne 0x10006aa4
cmp dword [0x10020664], ebx
jne 0x10006aa4
call fcn.10002fec
call fcn.1000321c
push ebx
call fcn.100017d0
mov esi, 0x1f5
jmp 0x10006c6d
cmp dword [0x10020664], ebx
je 0x10006aa4
push 0x1000250c
push 0x80000002
call fcn.10001720
call fcn.10001f6c
call fcn.10007274
push 0x1f8
call fcn.10005260
cmp dword [ebp - 4], ebx
je 0x10006abe
push ebx
call fcn.100022e4
call fcn.10003a44
cmp dword [0x10020664], ebx
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
je 0x10006b07
cmp dword [ebp - 4], ebx
jne 0x10006b07
push fcn.10002b57
call fcn.1000540c
push fcn.10001c08
mov edi, eax
call fcn.1000540c
mov ebx, eax
push 1
push ebx
push edi
call esi
test eax, eax
jne 0x10006af9
push 5
push ebx
push edi
call esi
push edi
call fcn.100052f4
push ebx
call fcn.100052f4
xor ebx, ebx
cmp dword [0x1002066c], ebx
jne fcn.10006e26
cmp dword [0x10020694], ebx
je fcn.10006b7d
cmp word [0x100179a4], bx
je 0x10006b30
push 0x100179a4
call fcn.1000223c
jmp fcn.10006b7d
lea eax, [ebp - 0x210]
push eax
push 0x2e
call fcn.10006f30
test eax, eax
je 0x10006c68
push 0x266
call fcn.10002c7c
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.1000305c
lea eax, [ebp - 0x210]
push eax
call fcn.1000223c
lea eax, [ebp - 0x210]
push eax
push 0x100179a4
call dword [fcn.100076d0]
pop ecx
pop ecx
mov esi, 0x264
push dword [0x10020650]
call fcn.100017d0
push dword [ebp + 0xc]
call fcn.10005ec4
push dword [0x10020748]
call fcn.10003b58
push ebx
push 1
push esi
push dword [ebp + 8]
call fcn.10002607
xor eax, eax
jmp 0x10006f28
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10006b07
Capabilities:
Delete file
Move file

Disassembly:
call fcn.1000269c
call fcn.10005360
mov eax, dword [0x10017a64]
push 1
mov dword [ebp + 0xc], eax
call fcn.100017d0
mov eax, dword [0x10020668]
neg eax
sbb eax, eax
and eax, 2
inc eax
inc eax
push eax
call fcn.10005ec4
push ebx
call fcn.10003b58
push 0x202
call fcn.10005260
cmp dword [0x1002066c], ebx
jne 0x10006a25
push ebx
push ebx
push 1
push 1
call fcn.10001e30
test eax, eax
jne 0x10006a2a
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
jmp 0x10006c6d
call fcn.100013a2
push 0x201
call fcn.10005260
push dword [ebp + 8]
call fcn.10005d04
push 0x1f7
call fcn.10005260
cmp dword [0x1002066c], ebx
jne 0x10006a83
cmp dword [ebp - 4], ebx
je 0x10006aa4
push 0x10017984
call fcn.10002a94
test eax, eax
jne 0x10006aa4
cmp dword [0x10020664], ebx
jne 0x10006aa4
call fcn.10002fec
call fcn.1000321c
push ebx
call fcn.100017d0
mov esi, 0x1f5
jmp 0x10006c6d
cmp dword [0x10020664], ebx
je 0x10006aa4
push 0x1000250c
push 0x80000002
call fcn.10001720
call fcn.10001f6c
call fcn.10007274
push 0x1f8
call fcn.10005260
cmp dword [ebp - 4], ebx
je 0x10006abe
push ebx
call fcn.100022e4
call fcn.10003a44
cmp dword [0x10020664], ebx
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
je 0x10006b07
cmp dword [ebp - 4], ebx
jne 0x10006b07
push fcn.10002b57
call fcn.1000540c
push fcn.10001c08
mov edi, eax
call fcn.1000540c
mov ebx, eax
push 1
push ebx
push edi
call esi
test eax, eax
jne 0x10006af9
push 5
push ebx
push edi
call esi
push edi
call fcn.100052f4
push ebx
call fcn.100052f4
xor ebx, ebx
cmp dword [0x1002066c], ebx
jne fcn.10006e26
cmp dword [0x10020694], ebx
je fcn.10006b7d
cmp word [0x100179a4], bx
je 0x10006b30
push 0x100179a4
call fcn.1000223c
jmp fcn.10006b7d
lea eax, [ebp - 0x210]
push eax
push 0x2e
call fcn.10006f30
test eax, eax
je 0x10006c68
push 0x266
call fcn.10002c7c
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.1000305c
lea eax, [ebp - 0x210]
push eax
call fcn.1000223c
lea eax, [ebp - 0x210]
push eax
push 0x100179a4
call dword [fcn.100076d0]
pop ecx
pop ecx
mov esi, 0x264
push dword [0x10020650]
call fcn.100017d0
push dword [ebp + 0xc]
call fcn.10005ec4
push dword [0x10020748]
call fcn.10003b58
push ebx
push 1
push esi
push dword [ebp + 8]
call fcn.10002607
xor eax, eax
jmp 0x10006f28
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10006e26
Capabilities:
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
lea eax, [ebp - 0x210]
push eax
push 0x2e
call fcn.10006f30
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10006e8e
push 0x266
call fcn.10002c7c
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.1000305c
lea eax, [ebp - 0x210]
push eax
call edi
and al, 0xfb
push eax
lea eax, [ebp - 0x210]
push eax
call ebx
lea eax, [ebp - 0x210]
push 0x100023ba
push eax
call fcn.1000305c
push 4
lea eax, [ebp - 0x210]
push 0
push eax
call esi
lea eax, [ebp - 0x210]
push eax
push 0x2e
call fcn.10006f30
test eax, eax
je 0x10006eea
push 0x265
call fcn.10002c7c
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.1000305c
lea eax, [ebp - 0x210]
push eax
call edi
and al, 0xfb
push eax
lea eax, [ebp - 0x210]
push eax
call ebx
lea eax, [ebp - 0x210]
push 0x100023ba
push eax
call fcn.1000305c
push 4
lea eax, [ebp - 0x210]
push 0
push eax
call esi
push 0x10002b29
push 0x80000000
call fcn.10003578
push 0
push 1
push fcn.100069c4
push 0x80000002
call fcn.10001b28
mov esi, eax
test esi, esi
je 0x10006f25
push 0x10001d55
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax

Function at 0x10006f30
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5fc
push esi
mov dword [ebp - 8], 0x3e8
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100018a0
test eax, eax
jne 0x10006fe0
lea eax, [ebp - 4]
push eax
push 0x100058ca
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x10006fe5
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x5fc]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x10003acf
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10006fe5
lea eax, [ebp - 0x214]
push 0x208
push eax
lea eax, [ebp - 0x5fc]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp dword [ebp + 8], 0x23
jne 0x10006fe5
push 0x26c
call fcn.10002c7c
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.1000305c
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 1
pop eax
jmp 0x10006fe7
xor eax, eax
pop esi
leave
ret 8

Function at 0x10007094
Capabilities:
Accept command line arguments

Disassembly:
mov dword [0x1002065c], ebx
and eax, 0x10
mov dword [0x10020664], edx
or eax, ebx
je 0x100070ad
mov dword [0x10020664], ebx
xor eax, eax
cmp dword [0x10017b4c], ebx
mov edi, dword [0x10007a18]
mov esi, 0x10020770
sete al
mov dword [0x10020668], eax
mov eax, esi
test eax, eax
je 0x100070d8
push esi
call edi
pop ecx
lea eax, [eax + eax + 2]
jmp 0x100070da
xor eax, eax
add eax, 0x104
push eax
call fcn.10002ff8
cmp eax, ebx
mov dword [0x100178b0], eax
jne fcn.100070f5
push 8
jmp 0x10005180
Function at 0x100070f5
Capabilities:
Accept command line arguments

Disassembly:
push esi
mov esi, dword [fcn.100076d0]
push eax
call esi
pop ecx
pop ecx
push dword [0x100178b0]
call edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
mov ecx, eax
mov eax, dword [0x100178b0]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x1000712e
push fcn.10003b58
push eax
call edi
mov eax, dword [0x100178b0]
pop ecx
pop ecx
cmp dword [0x10020664], ebx
je 0x10007142
push 0x10001fb1
push eax
call edi
pop ecx
pop ecx
jmp 0x1000714d
push eax
call fcn.10003b58
mov dword [0x100178b0], eax
cmp dword [0x10020664], ebx
push 1
pop edi
je fcn.1000715e
mov dword [0x10020658], edi

Function at 0x1000715e
Capabilities:
Accept command line arguments

Disassembly:
pop eax
jmp 0x1000726a
mov eax, dword [0x10020738]
cmp eax, ebx
jne 0x100071c3
lea eax, [ebp - 0x22c]
push 0x104
push eax
push dword [0x10020748]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x22c]
push 0x5c
push eax
call dword [fcn.100076d0]
pop ecx
cmp eax, ebx
pop ecx
je 0x100071bc
add eax, 2
push 0x10006c9e
push eax
call esi
pop ecx
lea eax, [ebp - 0x22c]
pop ecx
push ebx
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
cmp eax, 0xffffffff
mov dword [0x10020738], eax
jne 0x100071c3
push 2
jmp 0x10005180
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
call fcn.100065f8
push dword [0x10020664]
call fcn.10005973
push 0x10020748
push 0x10017a64
push 0x10020650
call fcn.10005801
cmp dword [0x10020664], ebx
je 0x10007217
call fcn.10002804
test eax, eax
jne 0x10007209
cmp dword [0x1002065c], ebx
je 0x1000720f
mov dword [0x1002066c], ebx
cmp dword [0x10020664], ebx
jne 0x10007221
mov eax, dword [0x10020650]
mov dword [0x1002066c], eax
lea eax, [ebp - 0x24]
mov word [0x100205a4], bx
push eax
mov word [0x1001715c], di
mov dword [0x1001775c], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x24], bx
jne 0x1000724c
push 0x10001fb1
jmp 0x10007258
cmp word [ebp - 0x24], 2
jne 0x10007263
push 0x10003971
push 0x100073a1
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call fcn.10003c72
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x10007274
Capabilities:
Accept command line arguments
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push ebx
push esi
or dword [ebp - 0xc], 0xffffffff
push edi
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x230]
xor esi, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x230]
push 0x208
push eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0xf000c
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100073f0
lea eax, [ebp - 0x230]
push fcn.100068e8
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
push 2
push esi
call fcn.10003bb0
cmp eax, esi
mov dword [ebp - 8], eax
je 0x1000740a
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor ebx, ebx
cmp dword [ebp - 4], esi
jbe 0x10007320
mov esi, eax
push 0x10002c5c
push dword [esi]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x10007315
push 0x10003971
push dword [esi + 8]
call edi
pop ecx
test eax, eax
pop ecx
je 0x1000731e
inc ebx
add esi, 0xc
cmp ebx, dword [ebp - 4]
jb 0x100072f6
xor esi, esi
push dword [ebp - 8]
call fcn.100052f4
cmp ebx, dword [ebp - 4]
jae 0x1000740a
lea eax, [ebp - 4]
push 6
push eax
push 2
push esi
call fcn.10002cc8
cmp eax, esi
mov dword [ebp - 8], eax
je 0x100073a9
xor ebx, ebx
cmp dword [ebp - 4], esi
jbe 0x100073a1
lea esi, [eax + 0xc]

Function at 0x10007320
Capabilities:
Accept command line arguments
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push ebx
push esi
or dword [ebp - 0xc], 0xffffffff
push edi
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x230]
xor esi, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x230]
push 0x208
push eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0xf000c
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100073f0
lea eax, [ebp - 0x230]
push fcn.100068e8
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
push 2
push esi
call fcn.10003bb0
cmp eax, esi
mov dword [ebp - 8], eax
je 0x1000740a
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor ebx, ebx
cmp dword [ebp - 4], esi
jbe 0x10007320
mov esi, eax
push 0x10002c5c
push dword [esi]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x10007315
push 0x10003971
push dword [esi + 8]
call edi
pop ecx
test eax, eax
pop ecx
je 0x1000731e
inc ebx
add esi, 0xc
cmp ebx, dword [ebp - 4]
jb 0x100072f6
xor esi, esi
push dword [ebp - 8]
call fcn.100052f4
cmp ebx, dword [ebp - 4]
jae 0x1000740a
lea eax, [ebp - 4]
push 6
push eax
push 2
push esi
call fcn.10002cc8
cmp eax, esi
mov dword [ebp - 8], eax
je 0x100073a9
xor ebx, ebx
cmp dword [ebp - 4], esi
jbe 0x100073a1
lea esi, [eax + 0xc]
Function at 0x10007350
Capabilities:
Accept command line arguments
Move file

Disassembly:
push 0x1000714d
push dword [esi + 4]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x10007396
push fcn.100069c4
push dword [esi]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x10007396
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [esi - 8]
call fcn.10002d64
test eax, eax
je 0x10007396
push dword [ebp - 0x10]
call fcn.10002584
push dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
call fcn.1000361c
inc ebx
add esi, 0x54
cmp ebx, dword [ebp - 4]
jb fcn.10007350
xor esi, esi
push dword [ebp - 8]
call fcn.100052f4
mov edi, 0x10002c5c
push edi
push esi
push esi
call fcn.10003054
push 4
lea eax, [ebp - 0x230]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], edi
push eax
push 2
push esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 0x10007268
call fcn.10002a68
test eax, eax
jne 0x100073f4
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
cmp eax, 0xbbe
je 0x100073f4
xor eax, eax
jmp 0x1000740d
cmp dword [ebp - 0xc], 0xffffffff
je 0x1000740a
push 0x1fb
call fcn.10002c7c
push eax
call fcn.10002a94
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10007494
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov ebx, 0x104
jne 0x100074ef
lea eax, [ebp - 0x228]
push ebx
push eax
push 0x100014e9
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0xc]
push eax
push 2
lea eax, [ebp - 0x228]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x100075d1
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x20]
mov edi, fcn.10004f90
push eax
push esi
mov esi, dword [pe_dos_header]
push edi
push dword [ebp + 8]
call esi
test eax, eax
je 0x10007557
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x228]
push ebx
push eax
lea eax, [ebp - 0x20]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
test eax, eax
je 0x10007547
lea eax, [ebp - 0x228]
test eax, eax
je 0x10007542
lea eax, [ebp - 0x228]
push eax
call fcn.10001f64
pop ecx
lea eax, [eax + eax + 2]
jmp 0x10007544
xor eax, eax
add dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [pe_dos_header]
jmp 0x10007505
mov eax, dword [ebp - 4]
add eax, 0x10
push eax
call fcn.10002ff8
test eax, eax
mov dword [ebp - 8], eax
je 0x100075cf
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
push 0
push edi
push dword [ebp + 8]
call esi
test eax, eax
je 0x100075cf
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x228]
push ebx
push eax
lea eax, [ebp - 0x20]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
test eax, eax
je 0x100075bf
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x228]
push eax
push esi
call fcn.10003614
pop ecx
lea eax, [ebp - 0x228]
pop ecx
push eax
call fcn.10001f64
lea eax, [esi + eax*2 + 2]
pop ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [pe_dos_header]
jmp 0x10007579
xor esi, esi
cmp dword [ebp - 0x10], esi
je 0x100075df
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10007547
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov ebx, 0x104
jne 0x100074ef
lea eax, [ebp - 0x228]
push ebx
push eax
push 0x100014e9
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0xc]
push eax
push 2
lea eax, [ebp - 0x228]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x100075d1
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x20]
mov edi, fcn.10004f90
push eax
push esi
mov esi, dword [pe_dos_header]
push edi
push dword [ebp + 8]
call esi
test eax, eax
je 0x10007557
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x228]
push ebx
push eax
lea eax, [ebp - 0x20]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
test eax, eax
je 0x10007547
lea eax, [ebp - 0x228]
test eax, eax
je 0x10007542
lea eax, [ebp - 0x228]
push eax
call fcn.10001f64
pop ecx
lea eax, [eax + eax + 2]
jmp 0x10007544
xor eax, eax
add dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [pe_dos_header]
jmp 0x10007505
mov eax, dword [ebp - 4]
add eax, 0x10
push eax
call fcn.10002ff8
test eax, eax
mov dword [ebp - 8], eax
je 0x100075cf
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
push 0
push edi
push dword [ebp + 8]
call esi
test eax, eax
je 0x100075cf
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x228]
push ebx
push eax
lea eax, [ebp - 0x20]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
test eax, eax
je 0x100075bf
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x228]
push eax
push esi
call fcn.10003614
pop ecx
lea eax, [ebp - 0x228]
pop ecx
push eax
call fcn.10001f64
lea eax, [esi + eax*2 + 2]
pop ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [pe_dos_header]
jmp 0x10007579
xor esi, esi
cmp dword [ebp - 0x10], esi
je 0x100075df
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10007c0a
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
push esi
jne 0x10007ce7
mov eax, 0x94
call fcn.100088e0
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10007cae
mov ecx, dword [esi + 0x10]
mov dword [0x10020808], ecx
mov eax, dword [esi + 4]
mov dword [0x10020814], eax
mov edx, dword [esi + 8]
mov dword [0x10020818], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x1002080c], esi
je 0x10007c6f
or esi, 0x8000
mov dword [0x1002080c], esi
shl eax, 8
add eax, edx
xor esi, esi
push esi
mov dword [0x10020810], eax
call fcn.1000865a
test eax, eax
pop ecx
je 0x10007cae
call fcn.1000884c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10020d34], eax
call fcn.1000872a
mov dword [0x1002079c], eax
call fcn.1000819d
test eax, eax
jge 0x10007cb2
call fcn.100086ab
xor eax, eax
jmp 0x10007cd8
call fcn.1000859e
test eax, eax
jl 0x10007ce0
call fcn.1000836b
test eax, eax
jl 0x10007ce0
push esi
call fcn.10008052
test eax, eax
pop ecx
jne 0x10007ce0
inc dword [0x10020798]
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc
call fcn.10008348
jmp 0x10007ca9
xor esi, esi
cmp dword [ebp + 0xc], esi
jne 0x10007cd5
cmp dword [0x10020798], esi
jle 0x10007cae
dec dword [0x10020798]
cmp dword [0x10020844], esi
jne 0x10007d09
call fcn.1000818e
call fcn.10008348
call fcn.100086ab
jmp 0x10007cd5
Function at 0x100080bc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x10020848], esi
push edi
jne 0x100080dc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x10020844], esi
mov byte [0x10020840], al
jne 0x10008142
mov ecx, dword [0x10020d28]
test ecx, ecx
je 0x10008123
mov eax, dword [0x10020d24]
sub eax, 4
cmp eax, ecx
jmp 0x1000811c
mov eax, dword [eax]
test eax, eax
je 0x1000810e
call eax
mov eax, dword [0x10020d24]
sub eax, 4
cmp eax, dword [0x10020d28]
mov dword [0x10020d24], eax
jae 0x10008106
mov eax, 0x1001701c
mov esi, 0x10017020
cmp eax, esi
mov edi, eax
jae 0x10008142
mov eax, dword [edi]
test eax, eax
je 0x1000813b
call eax
add edi, 4
cmp edi, esi
jb 0x10008133
mov eax, 0x10017024
mov esi, 0x10017028
cmp eax, esi
mov edi, eax
jae 0x10008161
mov eax, dword [edi]
test eax, eax
je 0x1000815a
call eax
add edi, 4
cmp edi, esi
jb 0x10008152
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x1000817b
push dword [ebp + 8]
mov dword [0x10020848], 1
call fcn.10008022
pop ebp
ret

Function at 0x10009d06
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x10020968], ebx
push esi
push edi
jne 0x10009d86
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10009dc1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x10020968], eax
je 0x10009dc1
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x1002096c], eax
call esi
cmp dword [0x10020808], 2
mov dword [0x10020970], eax
jne 0x10009d86
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x10020978], eax
je 0x10009d86
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x10020974], eax
mov eax, dword [0x10020974]
test eax, eax
je 0x10009dcb
call eax
test eax, eax
je 0x10009db2
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x10020978]
test eax, eax
je 0x10009db2
test byte [ebp - 8], 1
jne 0x10009dcb
cmp dword [0x10020814], 4
jb 0x10009dc5
or byte [ebp + 0x12], 0x20
jmp 0x10009dea
xor eax, eax
jmp 0x10009dfa
or byte [ebp + 0x12], 4
jmp 0x10009dea
mov eax, dword [0x1002096c]
test eax, eax
je 0x10009dea
call eax
mov ebx, eax
test ebx, ebx
je 0x10009dea
mov eax, dword [0x10020970]
test eax, eax
je 0x10009dea
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x10020968]
pop edi
pop esi
pop ebx
leave
ret