joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404a40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406978
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x409008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x404a76
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x404b26
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.00404d30
test al, al
je 0x404acf
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x404b12
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404b08
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404b08
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00404e6f
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00404e2e
mov esp, ebp
pop ebp
ret
Function at 0x1001610
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100b21c]
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp eax, 2
push edi
mov byte [ebp - 0x1c], bl
mov byte [ebp - 0x1b], bl
mov byte [ebp - 0x1a], bl
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], 5
mov dword [ebp - 0x14], ebx
jne 0x1001715
lea eax, [ebp - 0xc]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1001715
lea eax, [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push eax
push ebx
push ebx
push 2
push dword [ebp - 0xc]
call edi
test eax, eax
jne 0x100168a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x100168a
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x10016fe
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push 2
push dword [ebp - 0xc]
call edi
test eax, eax
je 0x10016fe
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
lea eax, [ebp - 0x1c]
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10016fe
cmp dword [esi], ebx
mov dword [ebp - 8], ebx
jbe 0x10016f5
lea edi, [esi + 4]
push dword [ebp - 0x10]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x10016ea
inc dword [ebp - 8]
add edi, 8
mov eax, dword [ebp - 8]
cmp eax, dword [esi]
jb 0x10016cc
jmp 0x10016f5
push 1
pop eax
mov dword [0x100b21c], eax
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
je 0x1001712
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001b78
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push esi
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1001ba4
xor esi, esi
push esi
push 0x10
push esi
push esi
push 0x4f5
jmp 0x1001bfb
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push 0x10012f8
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
push esi
jne 0x1001be5
push 0x10
push esi
push esi
push 0x4f6
jmp 0x1001bfb
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x1001c05
push esi
push 0x10
push esi
push esi
push 0x4f7
push esi
call fcn.01003d16
xor eax, eax
jmp 0x1001c08
push 1
pop eax
pop esi
leave
ret

Function at 0x1001c0b
Capabilities:
Shutdown system

Disassembly:
test byte [esp + 4], 2
je 0x1001c17
push 2
pop eax
jmp 0x1001c1c
call fcn.01001b4e
cmp eax, 2
jne 0x1001c64
test byte [esp + 4], 4
je 0x1001c2d
push 6
pop eax
jmp 0x1001c44
push 4
push 0x40
push 0
push 0x10012d4
push 0x522
push 0
call fcn.01003d16
cmp eax, 6
jne 0x1001c64
cmp word [0x100cc04], 0
jne 0x1001c5f
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x1001c64
call fcn.01001b78
ret 4

Function at 0x1001c67
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x100b300], 0
je 0x1001caa
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001caa
push 0x100b300
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret
Function at 0x1001ea1
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
push ebx
xor ebx, ebx
cmp byte [0x100b300], bl
je 0x1001f99
lea eax, [ebp - 4]
push eax
push 0x2001f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001f99
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x344]
push eax
push ebx
mov esi, 0x100b300
push ebx
push esi
mov dword [ebp - 8], 0x238
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001f8f
mov al, byte [0x10012d4]
push edi
push 0x40
mov byte [ebp - 0x10c], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1001f4a
lea eax, [ebp - 0x10c]
push 0x10012d4
push eax
call fcn.01005ab2
lea eax, [ebp - 0x10c]
push 0x100be84
push eax
lea eax, [ebp - 0x344]
push str.rundll32.exe__sadvpack.dll_DelNodeRunDLL32___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x344]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x344]
push eax
push 1
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
leave
ret
Function at 0x1001f9c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x10020c5
cmp byte [ebx], 0
je 0x10020c5
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x104]
push ebx
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x104]
push 0x1001330
push eax
call esi
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x10020c5
lea eax, [ebp - 0x104]
push ebx
push eax
call edi
test byte [ebp - 0x244], 0x10
je 0x100206e
lea eax, [ebp - 0x218]
push 0x100132c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x100209d
lea eax, [ebp - 0x218]
push 0x1001328
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x100209d
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x104]
push 0x10012d4
push eax
call fcn.01005ab2
lea eax, [ebp - 0x104]
push eax
call fcn.01001f9c
jmp 0x100209d
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x104]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x244]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1002000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1002102
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
lea eax, [ebp - 0x104]
push 0x104
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x100216f
lea eax, [ebp - 0x104]
push 0x1001334
push eax
call fcn.01005ab2
lea eax, [ebp - 0x104]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x104]
push 0x40
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, 0xffffffff
je 0x100216f
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll__llseek]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x1002175
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10021be
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10021b5
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
Function at 0x10021c6
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002213
push esi
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x100220a
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret 4

Function at 0x1002268
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1002285
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x1002288
and eax, 0x10
ret 4

Function at 0x100239e
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
push ebx
push esi
and byte [eax], 0
push edi
mov edi, dword [ebp + 0x10]
cmp byte [edi], 0x23
jne 0x10024b2
movsx eax, byte [edi + 1]
inc edi
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
mov esi, dword [sym.imp.USER32.dll_CharNextA]
push edi
mov bl, al
call esi
push eax
call esi
cmp bl, 0x53
mov edi, eax
je 0x10024aa
cmp bl, 0x57
je 0x100249c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x10c]
mov ebx, 0x104
push 0x1001344
push eax
mov dword [ebp - 8], ebx
call esi
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.01005ab2
lea eax, [ebp + 0x10]
push eax
push 0x20019
lea eax, [ebp - 0x10c]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10024bc
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0xc]
push dword [ebp + 8]
push eax
push 0
push 0x10012d4
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002491
cmp dword [ebp + 0xc], 2
jne 0x1002484
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x1002484
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 8]
call esi
jmp 0x100248a
cmp dword [ebp + 0xc], 1
jne 0x1002491
mov dword [ebp - 4], 1
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10024bc
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x10024bc
push dword [ebp + 0xc]
push dword [ebp + 8]
jmp 0x10024b6
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 4], 0
jne 0x10024cb
push edi
push dword [ebp + 8]
call fcn.01005ab2
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10024d5
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp dword [ebx + 0x7c], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
jle 0x1002621
mov dword [ebp + 8], edi
mov ecx, dword [ebp + 8]
mov eax, ebx
add eax, dword [ebx + 0x80]
lea esi, [eax + ecx + 0x84]
mov eax, dword [eax + ecx + 0xbc]
lea eax, [eax + ebx + 0x84]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0100239e
test eax, eax
je 0x1002635
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, edi
mov dword [ebp - 0x14], eax
je 0x10025fb
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, edi
mov dword [ebp - 4], eax
je 0x1002635
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x1002633
push edi
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 0xc]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x10025ee
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x1001378
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10025ee
xor edi, edi
cmp dword [ebp - 0x1c], edi
je 0x10025ee
add esi, 0x10
push dword [esi - 0xc]
mov eax, dword [ebp - 0xc]
push dword [esi - 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.01002672
push dword [esi]
mov dword [ebp + edi - 0x24], eax
mov eax, dword [ebp - 0xc]
push dword [esi - 4]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.01002672
mov dword [ebp + edi - 0x2c], eax
add edi, 4
add esi, 0x18
cmp edi, 8
jl 0x100259c
cmp dword [ebp - 0x24], 0
jl 0x10025e2
cmp dword [ebp - 0x2c], 0
jle 0x10025ee
cmp dword [ebp - 0x20], 0
jl 0x100262a
cmp dword [ebp - 0x28], 0
jg 0x100262a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor edi, edi
jmp 0x100260e
cmp dword [esi], edi
jne 0x1002635
cmp dword [esi + 4], edi
jne 0x1002635
cmp dword [esi + 0xc], edi
jne 0x1002635
cmp dword [esi + 0x10], edi
jne 0x1002635
inc dword [ebp - 8]
add dword [ebp + 8], 0x3c
mov eax, dword [ebp - 8]
cmp eax, dword [ebx + 0x7c]
jl 0x10024f8
mov dword [ebp - 0x10], 1
jmp 0x1002635
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor edi, edi
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
cmp dword [ebp - 4], edi
mov dword [eax], ecx
je 0x100264b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x100279b
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x10027c4
mov al, byte [esi + 1]
inc esi
test al, al
je 0x10027bc
cmp al, 0x22
jne 0x10027b0
cmp byte [esi], 0x22
jne 0x10027ce
inc esi
jmp 0x10027ce
cmp al, 0x20
jle 0x10027ce
inc esi
cmp byte [esi], 0x20
jg 0x10027c8
mov al, byte [esi]
test al, al
je 0x10027db
cmp al, 0x20
jg 0x10027db
inc esi
jmp 0x10027ce
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x10027f5
movzx eax, word [ebp - 0x14]
jmp 0x10027f8
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1002877
Capabilities:
Check mutex on windows
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [0x100c6dc], eax
mov ecx, 0x23f
xor eax, eax
mov edi, 0x100bde0
rep stosd dword es:[edi], eax
mov ecx, 0xcb
mov edi, 0x100baa0
rep stosd dword es:[edi], eax
push 0x41
mov edi, 0x100c720
pop ecx
mov esi, 0x100bdf4
rep stosd dword es:[edi], eax
push 1
xor ebx, ebx
pop edi
mov dword [ebp - 4], ebx
push 0x7f
push esi
push 0x10013b4
mov dword [0x100c08c], edi
call fcn.01003e69
cmp eax, ebx
je 0x1002a96
cmp eax, 0x80
ja 0x1002a96
push ebx
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
mov dword [0x100ba7c], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 4
push 0x100c6d4
push 0x10013a8
call fcn.01003e69
test eax, eax
je 0x1002934
test byte [0x100c6d4], 0xc0
je 0x10029c4
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0x1001398
call fcn.01003e69
test eax, eax
jne 0x1002953
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.01003d16
mov dword [0x100c704], 0x80070714
jmp 0x1002aa6
lea eax, [ebp - 0x108]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [0x100ba80], eax
je 0x10029c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10029c4
test byte [0x100c6d4], 0x80
je 0x1002993
push ebx
push 0x10
push ebx
push esi
push 0x54b
push ebx
call fcn.01003d16
jmp 0x10029a9
push 4
push 0x20
push ebx
push esi
push 0x524
push ebx
call fcn.01003d16
cmp eax, 6
je 0x10029c4
push dword [0x100ba80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x100c704], 0x800700b7
jmp 0x1002aa6
push dword [ebp + 0xc]
mov dword [0x100c824], ebx
call fcn.0100525e
test eax, eax
jne 0x10029e5
push ebx
push 0x10
push ebx
push ebx
push 0x520
jmp 0x1002aa0
cmp byte [0x100baba], bl
je 0x10029fc
push 0x100baba
call fcn.01001f9c
jmp 0x1002aa6
push 0xa
push 0x100138c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x1002a1d
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [0x100b2f8], ebx
je 0x1002a2b
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
cmp dword [0x100baa4], ebx
jne 0x1002a92
push dword [ebp - 4]
call fcn.0100319a
test eax, eax
je 0x1002aa6
mov ax, word [0x100cc04]
cmp ax, di
je 0x1002a50
cmp ax, 2
jne 0x1002a92
test byte [0x100c6d5], 1
je 0x1002a92
test byte [0x100bab8], 1
jne 0x1002a92
call fcn.01001610
test eax, eax
jne 0x1002a92
push 0x83e
push 0x547
push 0x100171a
push ebx
push 0x7d6
push dword [0x100c6dc]
call fcn.01005990
cmp eax, 0x83d
jne 0x1002aa6
mov eax, edi
jmp 0x1002aa8
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.01003d16
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1002baf
Capabilities:
Delete file
Set current directory
Set file attributes

Disassembly:
jmp 0x10049f6
sub esp, 0x104
push ebx
push ebp
push esi
mov esi, dword [0x100be80]
xor ebp, ebp
push edi
cmp esi, ebp
mov edi, esi
je 0x1004a49
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x100baa4], ebp
jne 0x1004a39
cmp dword [0x100c6d0], ebp
jne 0x1004a39
push 0x80
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [edi]
mov esi, dword [esi + 4]
call ebx
push edi
call ebx
cmp esi, ebp
mov edi, esi
jne 0x1004a14
cmp dword [0x100baa0], ebp
je 0x1004a99
cmp dword [0x100baa4], ebp
jne 0x1004a99
cmp dword [0x100c6d0], ebp
jne 0x1004a99
lea eax, [esp + 0x10]
push 0x100be84
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test byte [0x100c6d4], 0x20
je 0x1004a84
lea eax, [esp + 0x10]
push eax
call fcn.01005af1
push 0x1001328
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [esp + 0x10]
push eax
call fcn.01001f9c
cmp word [0x100cc04], 1
je 0x1004ab0
cmp dword [0x100baa0], ebp
je 0x1004ab0
call fcn.01001c67
pop edi
mov dword [0x100baa0], ebp
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x100393f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
xor esi, esi
push 1
cmp dword [ebp + 8], esi
pop ebx
jne 0x100395b
xor eax, eax
jmp 0x1003a33
push edi
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push esi
push esi
push 0x20
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10039eb
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [0x100baa8], esi
mov ecx, dword [ebp + 0xc]
jne 0x10039c5
mov al, byte [0x100c6cc]
test bl, al
je 0x10039c5
test al, 2
jne 0x10039c5
mov eax, ecx
and eax, 0xff000000
cmp eax, 0xaa000000
jne 0x10039c5
mov dword [0x100c6cc], ecx
push ecx
call fcn.01003a39
push dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x10]
call edi
test byte [0x100c6d5], 4
je 0x1003a30
cmp dword [ebp + 0xc], esi
jge 0x1003a30
jmp 0x1003a2e
call fcn.01005763
mov dword [0x100c704], eax
push esi
lea eax, [ebp - 0x210]
push 0x200
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push esi
lea eax, [ebp - 0x210]
push 0x10
push eax
push dword [ebp + 8]
push 0x4c4
push esi
call fcn.01003d16
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8