joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100de637
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x624], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x418], ecx
call fcn.100de015
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 0
je 0x100de688
cmp dword [ebp - 0x628], 1
je 0x100de719
cmp dword [ebp - 0x628], 2
je 0x100de6d3
jmp 0x100de73e
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x620]
push eax
call fcn.10095a66
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x310]
push edx
call fcn.10095a66
add esp, 8
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x310]
push ecx
lea edx, [ebp - 0x620]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x100de6d1
mov dword [ebp - 4], 0
jmp 0x100de750
push 3
lea eax, [ebp - 0x414]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.100d39f8
add esp, 0x10
lea edx, [ebp - 0x414]
mov dword [ebp - 0x624], edx
push 3
lea eax, [ebp - 0x108]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.100d39f8
add esp, 0x10
lea edx, [ebp - 0x108]
mov dword [ebp - 0x418], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x418]
push ecx
mov edx, dword [ebp - 0x624]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x100de73c
mov dword [ebp - 4], 0
jmp 0x100de750
push 0x101569b0
push str.ntlangwrap_move_file
call fcn.10081153
add esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.100ce6f3
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.100ce6f3
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100de76f
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x624], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x418], ecx
call fcn.100de015
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 0
je 0x100de7c0
cmp dword [ebp - 0x628], 1
je 0x100de851
cmp dword [ebp - 0x628], 2
je 0x100de80b
jmp 0x100de876
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x620]
push eax
call fcn.10095a66
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x310]
push edx
call fcn.10095a66
add esp, 8
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x310]
push ecx
lea edx, [ebp - 0x620]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x100de809
mov dword [ebp - 4], 0
jmp 0x100de888
push 3
lea eax, [ebp - 0x414]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.100d39f8
add esp, 0x10
lea edx, [ebp - 0x414]
mov dword [ebp - 0x624], edx
push 3
lea eax, [ebp - 0x108]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.100d39f8
add esp, 0x10
lea edx, [ebp - 0x108]
mov dword [ebp - 0x418], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x418]
push ecx
mov edx, dword [ebp - 0x624]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x100de874
mov dword [ebp - 4], 0
jmp 0x100de888
push 0x101569d8
push str.ntlangwrap_copy_file
call fcn.10081153
add esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.100ce6f3
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.100ce6f3
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x100de8a7
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
call fcn.100de015
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0
je 0x100de8d8
cmp dword [ebp - 0x314], 1
je 0x100de91d
cmp dword [ebp - 0x314], 2
je 0x100de8fd
jmp 0x100de92c
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x310]
push ecx
call fcn.10095a66
add esp, 8
lea edx, [ebp - 0x310]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 4], eax
jmp 0x100de945
push 3
lea eax, [ebp - 0x108]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.100d39f8
add esp, 0x10
lea edx, [ebp - 0x108]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 4], eax
jmp 0x100de945
push 0x10156a00
push str.ntlangwrap_GetDriveType
call fcn.10081153
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100dec3a
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [ebp + 8]
mov dword [ebp - 0x314], eax
call fcn.100de015
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0
je 0x100dec74
cmp dword [ebp - 0x318], 1
je 0x100decbc
cmp dword [ebp - 0x318], 2
je 0x100dec99
jmp 0x100decce
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x310]
push edx
call fcn.10095a66
add esp, 8
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], eax
jmp 0x100dece7
push 3
lea ecx, [ebp - 0x108]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.100d39f8
add esp, 0x10
lea eax, [ebp - 0x108]
mov dword [ebp - 0x314], eax
mov ecx, dword [ebp - 0x314]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 4], eax
jmp 0x100dece7
push 0x10156aa8
push str.ntlangwrap_DeleteFile
call fcn.10081153
add esp, 8
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
push edx
call fcn.100ce6f3
add esp, 4
cmp dword [ebp - 4], 0
je 0x100decfd
xor eax, eax
jmp 0x100ded02
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x100df024
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [ebp + 8]
mov dword [ebp - 0x314], eax
call fcn.100de015
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0
je 0x100df05e
cmp dword [ebp - 0x318], 1
je 0x100df0a6
cmp dword [ebp - 0x318], 2
je 0x100df083
jmp 0x100df0b8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x310]
push edx
call fcn.10095a66
add esp, 8
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [ebp - 4], eax
jmp 0x100df0d1
push 3
lea ecx, [ebp - 0x108]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.100d39f8
add esp, 0x10
lea eax, [ebp - 0x108]
mov dword [ebp - 0x314], eax
mov ecx, dword [ebp - 0x314]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [ebp - 4], eax
jmp 0x100df0d1
push 0x10156b6c
push str.ntlangwrap_SetCurrentDirectory
call fcn.10081153
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100df0d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov dword [ebp - 0x10c], 0x103
call fcn.100de015
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0
je 0x100df113
cmp dword [ebp - 0x318], 1
je 0x100df17b
cmp dword [ebp - 0x318], 2
je 0x100df145
jmp 0x100df191
lea eax, [ebp - 0x314]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x100df143
lea edx, [ebp - 0x314]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.100957f3
add esp, 8
jmp 0x100df1aa
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x100df179
push 0
mov eax, dword [ebp + 8]
push eax
push 3
lea ecx, [ebp - 0x108]
push ecx
call fcn.100d39f8
add esp, 0x10
jmp 0x100df1aa
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
jmp 0x100df1aa
push str.invalid_action
push str.ntlangwrap_GetCurrentDirectory
call fcn.10081153
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x100e008c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], 0x10
mov eax, dword [0x10156cfc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x14]
push ecx
push str.NoDrives
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push reloc.WSOCK32.dll_accept
call fcn.100aef77
add esp, 0x10
test eax, eax
jne 0x100e00d0
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x10], 0x41
mov dword [ebp - 0x1c], 0
jmp 0x100e00ef
mov dl, byte [ebp - 0x10]
add dl, 1
mov byte [ebp - 0x10], dl
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
movsx ecx, byte [ebp - 0x10]
cmp ecx, 0x5a
jg 0x100e0155
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
shr edx, cl
and edx, 1
test edx, edx
jne 0x100e0109
jmp 0x100e00dd
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
shr eax, cl
and eax, 1
test eax, eax
je 0x100e011a
jmp 0x100e00dd
mov cl, byte [ebp - 0x10]
mov byte [ebp - 4], cl
lea edx, [ebp - 4]
push edx
call fcn.1009ca9c
add esp, 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 1
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.1009307b
add esp, 0xc
lea edx, [ebp - 0xc]
push edx
push 1
mov eax, dword [ebp + 0xc]
push eax
call fcn.1009307b
add esp, 0xc
jmp 0x100e00dd
mov esp, ebp
pop ebp
ret
Function at 0x100e0159
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4030
call fcn.100ec810
mov dword [ebp - 0x1c], 0x10
mov dword [ebp - 0x4024], 0x4000
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
push eax
call sub.MSVCR70D.dll_strlen
add esp, 4
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100dfbc3
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100e01ab
jmp 0x100e02e1
lea eax, [ebp - 0x4020]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], 0x103
je 0x100e02d8
mov dword [ebp - 0x4024], 0x4000
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4024]
push ecx
mov edx, dword [ebp - 0xc]
push edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.MPR.dll_WNetEnumResourceA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100e01f5
jmp 0x100e01b4
mov dword [ebp - 0x20], 0
jmp 0x100e0207
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 4]
jae 0x100e02d3
mov ecx, dword [ebp - 0x20]
shl ecx, 5
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x14]
mov dword [ebp - 0x4028], eax
cmp dword [ebp - 0x4028], 0
je 0x100e02ce
mov ecx, dword [ebp - 0x4028]
push ecx
call sub.MSVCR70D.dll_strlen
add esp, 4
cmp eax, dword [ebp - 8]
jbe 0x100e02ce
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x4028]
push ecx
call sub.MSVCR70D.dll__strnicmp
add esp, 0xc
test eax, eax
jne 0x100e02ce
mov edx, dword [ebp - 0x4028]
add edx, dword [ebp - 8]
mov dword [ebp - 0x4030], edx
mov eax, dword [ebp - 0x4030]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x100e0292
mov edx, dword [ebp - 0x4030]
add edx, 1
mov dword [ebp - 0x4030], edx
mov eax, dword [ebp - 0x4030]
push eax
call fcn.1009ca9c
add esp, 4
mov dword [ebp - 0x402c], eax
lea ecx, [ebp - 0x402c]
push ecx
push 1
mov edx, dword [ebp + 0x10]
push edx
call fcn.1009307b
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1009307b
add esp, 0xc
jmp 0x100e01fe
jmp 0x100e01b4
mov edx, dword [ebp - 0x10]
push edx
call sub.MPR.dll_WNetCloseEnum
mov esp, ebp
pop ebp
ret
Function at 0x100e3210
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
lea eax, [ebp - 0x280]
mov dword [ebp - 0x158], eax
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x17c], ecx
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCR70D.dll_atoi
add esp, 4
mov dword [ebp - 0x178], eax
mov eax, dword [ebp + 0x10]
push eax
call sub.MSVCR70D.dll_atoi
add esp, 4
mov dword [ebp - 8], eax
push 1
lea ecx, [ebp - 0x16c]
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cmp eax, 1
je 0x100e3289
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InitializeSecurityDescriptor_failed:__d
push 0x10156f84
call fcn.10081529
add esp, 0xc
mov eax, 1
jmp 0x100e3414
mov dword [ebp - 0x170], 0x104
mov dword [ebp - 0x284], 0x20
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x170]
push edx
mov eax, dword [ebp - 0x158]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
cmp eax, 1
je 0x100e32ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10156f90
push 0x10156fb0
call fcn.10081529
add esp, 0xc
mov eax, 1
jmp 0x100e3414
mov dword [ebp - 0x134], 0x104
mov dword [ebp - 0xc], 0x20
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x154]
push ecx
lea edx, [ebp - 0x134]
push edx
mov eax, dword [ebp - 0x17c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
cmp eax, 1
je 0x100e3350
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LookupAccountName_failed:__d
push 0x10156fdc
call fcn.10081529
add esp, 0xc
mov eax, 1
jmp 0x100e3414
push 0
mov edx, dword [ebp - 0x158]
push edx
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
cmp eax, 1
je 0x100e338e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetSecurityDescriptorOwner_failed:__d
push 0x10157010
call fcn.10081529
add esp, 0xc
mov eax, 1
jmp 0x100e3414
push 0
mov ecx, dword [ebp - 0x17c]
push ecx
lea edx, [ebp - 0x16c]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorGroup]
cmp eax, 1
je 0x100e33c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetSecurityDescriptorGroup_failed:__d
push 0x10157044
call fcn.10081529
add esp, 0xc
mov eax, 1
jmp 0x100e3414
mov dword [ebp - 0x174], 3
lea eax, [ebp - 0x16c]
push eax
mov ecx, dword [ebp - 0x174]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100dea94
add esp, 0xc
cmp eax, 1
je 0x100e3412
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetFileSecurity_failed:__d
push str.pfa_chown
call fcn.10081529
add esp, 0xc
mov eax, 1
jmp 0x100e3414
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100e4c84
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.100f7573
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100ce6f3
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100e4caa
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call sub.MSVCR70D.dll__mkdir
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100ce6f3
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x100e4e3a
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.100ce6f3
add esp, 4
cmp dword [ebp + 0xc], 0
je 0x100e4e71
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.100ce6f3
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x100e53f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0
jne 0x100e545b
push str.PRO_TK_DBG_DLL_LOAD
call sub.MSVCR70D.dll_getenv
add esp, 4
test eax, eax
je 0x100e543a
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Pro_ENGINEER
push str._s:_OS_error__d_while_loading__s_n_n
call fcn.1009d36b
add esp, 0x10
jmp 0x100e5457
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OS_error__d_while_loading__s
push str.dll_load
call fcn.10081472
add esp, 0x10
xor eax, eax
jmp 0x100e5460
mov eax, 1
pop ebp
ret

Function at 0x100ed7a0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10158750]
jne 0x100ed7a9
ret
jmp fcn.100ed7b0
Function at 0x100ef253
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x10158750]
xor eax, dword [ebp + 4]
mov dword [ebp - 0xc], eax
push edi
mov dword [ebp - 4], 0
mov byte [ebp - 0x410], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x40f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x414], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100efa26
movzx edx, al
test edx, edx
je 0x100ef3ba
mov ecx, 0x10183b94
call fcn.100efbc0
movzx eax, byte [eax + 0x42b]
test eax, eax
je 0x100ef308
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._s__d__:
mov eax, 0x400
sub eax, dword [ebp - 0x414]
push eax
mov ecx, dword [ebp - 0x414]
lea edx, [ebp + ecx - 0x410]
push edx
call fcn.100f6986
add esp, 0x14
mov ecx, dword [ebp - 0x414]
add ecx, eax
mov dword [ebp - 0x414], ecx
cmp dword [ebp - 8], 0
je 0x100ef361
mov ecx, 0x10183b94
call fcn.100efbc0
movzx edx, byte [eax + 0x42a]
test edx, edx
je 0x100ef361
mov ecx, dword [ebp - 8]
call fcn.100efbe0
push eax
push str._S:
mov eax, 0x400
sub eax, dword [ebp - 0x414]
push eax
mov ecx, dword [ebp - 0x414]
lea edx, [ebp + ecx - 0x410]
push edx
call fcn.100f6986
add esp, 0x10
mov ecx, dword [ebp - 0x414]
add ecx, eax
mov dword [ebp - 0x414], ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, 0x400
sub ecx, dword [ebp - 0x414]
push ecx
mov edx, dword [ebp - 0x414]
lea eax, [ebp + edx - 0x410]
push eax
call fcn.100f6930
add esp, 0x10
cmp dword [ebp - 4], 0
je 0x100ef3ad
lea ecx, [ebp - 0x410]
push ecx
push 0x10158f40
push 0
push 0
push 0
push 0
call dword [ebp - 4]
add esp, 0x18
jmp 0x100ef3ba
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0xc]
xor ecx, dword [ebp + 4]
call fcn.100ed7a0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x100f3cc7
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010aa98
push 0x100ee150
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov dword [ebp - 0x40], ecx
push 0
mov ecx, dword [ebp - 0x40]
call fcn.100f3df4
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp - 0x40]
cmp dword [edx + 0x24], 0
jne 0x100f3d1d
jmp 0x100f3d77
push 0
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [ebp - 0x40]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 0x40]
cmp dword [eax + 0x2c], 0
jne 0x100f3d46
jmp 0x100f3d77
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x40]
mov eax, dword [edx + 0x2c]
mov dword [ecx + 0x1c], eax
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ecx + 0x1c]
call fcn.100f47a0
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x38]
mov dword [eax + 0x20], ecx
mov edx, dword [ebp - 0x40]
mov byte [edx + 0x28], 1
mov dword [ebp - 4], 0xffffffff
call fcn.100f3d85
jmp 0x100f3ddb
mov edx, dword [ebp - 0x40]
mov al, byte [edx + 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100f6805
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x10183c34], esi
push edi
jne 0x100f6825
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x10183c30], esi
mov byte [0x10183c2c], al
jne 0x100f688b
mov ecx, dword [0x10184eb0]
test ecx, ecx
je 0x100f686c
mov eax, dword [0x10184eac]
sub eax, 4
cmp eax, ecx
jmp 0x100f6865
mov eax, dword [eax]
test eax, eax
je 0x100f6857
call eax
mov eax, dword [0x10184eac]
sub eax, 4
cmp eax, dword [0x10184eb0]
mov dword [0x10184eac], eax
jae 0x100f684f
mov eax, 0x101140dc
mov esi, 0x101140e8
cmp eax, esi
mov edi, eax
jae 0x100f688b
mov eax, dword [edi]
test eax, eax
je 0x100f6884
call eax
add edi, 4
cmp edi, esi
jb 0x100f687c
mov eax, 0x101140ec
mov esi, 0x101140f4
cmp eax, esi
mov edi, eax
jae 0x100f68aa
mov eax, dword [edi]
test eax, eax
je 0x100f68a3
call eax
add edi, 4
cmp edi, esi
jb 0x100f689b
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x100f68c5
push dword [ebp + 8]
mov dword [0x10183c34], 1
call fcn.100f673a
pop ecx
pop ebp
ret
Function at 0x100f72c4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
push 0x1010af38
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call sub.MSVCR70D.dll_getenv
mov esi, eax
or ebx, 0xffffffff
cmp esi, edi
pop ecx
je 0x100f7315
push edi
push esi
call sub.MSVCR70D.dll__access
cmp eax, ebx
pop ecx
pop ecx
jne 0x100f7340
mov eax, esi
call fcn.100f727a
cmp eax, edi
mov dword [ebp - 4], eax
je 0x100f7315
push edi
push eax
call sub.MSVCR70D.dll__access
cmp eax, ebx
pop ecx
pop ecx
je 0x100f7315
mov esi, dword [ebp - 4]
jmp 0x100f7340
mov esi, dword [ebp + 8]
cmp esi, edi
je 0x100f7329
push edi
push esi
call sub.MSVCR70D.dll__access
cmp eax, ebx
pop ecx
pop ecx
jne 0x100f7340
push edi
mov esi, 0x10103004
push esi
call sub.MSVCR70D.dll__access
cmp eax, ebx
pop ecx
pop ecx
jne 0x100f7340
mov esi, 0x10103a44
cmp dword [ebp + 0xc], edi
je 0x100f7351
push dword [ebp + 0xc]
call sub.MSVCR70D.dll_strlen
pop ecx
mov dword [ebp - 8], eax
push esi
call sub.MSVCR70D.dll_strlen
pop ecx
mov ecx, dword [ebp - 8]
lea eax, [eax + ecx + 0xc]
cmp eax, 0x104
ja 0x100f743a
push eax
call sub.MSVCR70D.dll_malloc
mov ebx, eax
cmp ebx, edi
pop ecx
je 0x100f743d
and byte [ebx], 0
push esi
push ebx
call sub.MSVCR70D.dll_strcat
push esi
call sub.MSVCR70D.dll_strlen
lea edi, [eax + esi - 1]
mov al, byte [edi]
add esp, 0xc
cmp al, 0x5c
jne 0x100f73a6
push 0x5c
push esi
call sub.MSVCR70D.dll__mbsrchr
pop ecx
pop ecx
cmp edi, eax
jmp 0x100f73a8
cmp al, 0x2f
je 0x100f73b7
push 0x10103004
push ebx
call sub.MSVCR70D.dll_strcat
pop ecx
pop ecx
cmp dword [ebp + 0xc], 0
je 0x100f73c8
push dword [ebp + 0xc]
push ebx
call sub.MSVCR70D.dll_strcat
pop ecx
pop ecx
push ebx
call sub.MSVCR70D.dll_strlen
mov esi, eax
mov eax, dword [ebp - 8]
add esi, ebx
cmp dword [0x10183d1c], eax
pop ecx
jae 0x100f73e8
mov dword [0x1015b2d4], 1
mov edi, dword [0x1015b2d4]
mov dword [0x10183d1c], eax
inc dword [0x1015b2d4]
mov eax, dword [0x1015b2d4]
sub eax, edi
cmp eax, 0x7fff
ja 0x100f742f
push 0xa
push esi
push dword [0x1015b2d4]
call fcn.100f8e21
push 0
push ebx
call sub.MSVCR70D.dll__access
add esp, 0x14
test eax, eax
je 0x100f73f3
cmp dword [0x10183be8], 0xd
je 0x100f73f3
jmp 0x100f743d
push ebx
call sub.MSVCR70D.dll_free
pop ecx
xor ebx, ebx
jmp 0x100f743d
mov ebx, dword [ebp + 0xc]
push dword [ebp - 4]
call sub.MSVCR70D.dll_free
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret