joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100113a0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100d00b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov edx, 0x100bb6bc
push ebx
mov ebx, dword [ebp + 8]
push esi
movzx esi, word [ebp + 0xc]
mov dword [ebp - 0x10c], eax
mov eax, ebx
mov dword [ebp - 0x110], ecx
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x100113f2
test cl, cl
je 0x100113ee
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x100113f2
add eax, 2
add edx, 2
test cl, cl
jne 0x100113d2
xor eax, eax
jmp 0x100113f7
sbb eax, eax
or eax, 1
test eax, eax
je 0x1001152f
mov ecx, 0x100bb6cc
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10011426
test dl, dl
je 0x10011422
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10011426
add eax, 2
add ecx, 2
test dl, dl
jne 0x10011406
xor eax, eax
jmp 0x1001142b
sbb eax, eax
or eax, 1
test eax, eax
je 0x1001152f
push edi
call fcn.1000f3f0
push dword [ebp - 0x10c]
mov edi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov dword [ebp - 0x118], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x110]
add ecx, 0x48
mov dword [ebp - 0x10c], eax
cmp dword [ecx + 0x14], 0x10
jb 0x1001147f
mov ecx, dword [ecx]
lea edx, [ebp - 0x108]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x10011485
mov esi, ebx
mov al, byte [ebx]
inc ebx
test al, al
jne 0x10011495
lea edi, [ebp - 0x108]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100114a5
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x108]
dec ecx
pop edi
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x100114c3
mov eax, dword [str..dll]
push 0
push 0x80
push 2
mov dword [ecx], eax
mov al, byte [0x100bb6e0]
push 0
push 2
mov byte [ecx + 4], al
lea eax, [ebp - 0x108]
push 0x40000000
push eax
mov dword [ebp - 0x114], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001152f
push 0
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x10c]
push dword [ebp - 0x118]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor al, al
pop esi
xor ecx, ebp
pop ebx
call fcn.1006c2b1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10011550
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x100d00b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [0x100ff5d4]
mov dword [ebp - 0x10c], eax
mov eax, dword fs:[0x2c]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov edx, dword [eax + edx*4]
mov eax, dword [0x10105828]
movzx esi, word [ebp + 0xc]
push edi
mov dword [ebp - 0x110], ecx
cmp eax, dword [edx + 4]
jle 0x100115da
push 0x10105828
call fcn.1006c45f
add esp, 4
cmp dword [0x10105828], 0xffffffff
jne 0x100115da
push 0x1c
lea eax, [ebp - 0x134]
push eax
push fcn.1000f3f0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov eax, dword [ebp - 0x130]
push 0x10105828
mov dword [0x1010582c], eax
call fcn.1006c420
add esp, 4
push dword [ebp - 0x10c]
mov edi, dword [0x1010582c]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov dword [ebp - 0x118], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x110]
add ecx, 0x48
mov dword [ebp - 0x10c], eax
cmp dword [ecx + 0x14], 0x10
jb 0x10011624
mov ecx, dword [ecx]
lea edx, [ebp - 0x108]
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x10011630
mov esi, ebx
mov al, byte [ebx]
inc ebx
test al, al
jne 0x10011640
lea edi, [ebp - 0x108]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10011650
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x108]
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x10011670
mov eax, dword [0x100bb6e4]
push 0
push 0x80
push 2
mov dword [ecx], eax
mov al, byte [0x100bb6e8]
push 0
push 2
mov byte [ecx + 4], al
lea eax, [ebp - 0x108]
push 0x40000000
push eax
mov dword [ebp - 0x114], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x100116dc
push 0
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x10c]
push dword [ebp - 0x118]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006c2b1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10011a10
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100d00b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 1
push ecx
call fcn.1000e190
mov ecx, eax
call fcn.1000ae80
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.1006fa30
push str.7D08CA1A
push str.GlobalNewIconMutex
lea eax, [ebp - 0x108]
push str._s__s
push eax
call fcn.10002370
add esp, 0x1c
lea eax, [ebp - 0x108]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x10011ab3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10011ab3
push str.icon_cant_run_two_instance__n
call fcn.1000e190
push eax
call fcn.1000b0b0
add esp, 8
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006c2b1
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x109]
mov byte [ebp - 0x109], 0
call fcn.1001f230
push edi
push 0x100bb780
push 0x100bb778
call fcn.10010030
push eax
call fcn.1001ee00
add esp, 0x10
test eax, eax
je 0x10011a9f
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
cmp byte [ebp + 0xc], 0
je 0x10011b0d
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006c2b1
mov esp, ebp
pop ebp
ret 8
mov ecx, esi
call fcn.100108a0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1006c2b1
mov esp, ebp
pop ebp
ret 8

Function at 0x10011b30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100ff5d4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10105970]
cmp eax, dword [ecx + 4]
jle 0x10011b80
push 0x10105970
call fcn.1006c45f
add esp, 4
cmp dword [0x10105970], 0xffffffff
jne 0x10011b80
push 0x100a3c50
mov byte [0x10105974], 0
call fcn.1006c89b
push 0x10105970
call fcn.1006c420
add esp, 8
push 1
push ecx
call fcn.1000e190
mov ecx, eax
call fcn.1000ae80
mov ecx, 0x10105974
jmp fcn.1001f230
Function at 0x10012270
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a29d0
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x100d00b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
lea ebx, [ecx + 0x48]
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x58]
mov esi, dword [ebp + 8]
mov edx, ebx
push edi
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x7c], 0
call fcn.10013cc0
push str..png
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.1000e020
add esp, 8
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x44]
cmp eax, 0x10
jb 0x100122ee
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.10001ca0
push edi
mov edx, ebx
mov dword [ebp - 0x44], 0xf
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x58], 0
call fcn.10013cc0
push str..ico
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
call fcn.1000e020
add esp, 8
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x5c]
cmp eax, 0x10
jb 0x1001233a
inc eax
lea ecx, [ebp - 0x70]
push eax
push dword [ebp - 0x70]
call fcn.10001ca0
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
push 0
cmovae eax, dword [ebp - 0x40]
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
mov dword [ebp - 0x5c], 0xf
mov dword [ebp - 0x60], 0
mov byte [ebp - 0x70], 0
mov dword [ebp - 0x74], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10012415
push 0
lea eax, [ebp - 0x74]
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x78]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0x10
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
cmovae edx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 0x10
cmovae ecx, dword [ebp - 0x40]
call fcn.1000e820
test al, al
je 0x10012415
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.100780fd
add esp, 4
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov ecx, esi
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.10001700
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x100123f7
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.10001ca0
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp ecx, 0x10
jb 0x10012470
inc ecx
push ecx
jmp 0x10012465
push 0
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], 0
push 0x100baf51
mov byte [esi], 0
call fcn.100017d0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x10012449
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.10001ca0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp eax, 0x10
jb 0x10012470
inc eax
push eax
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.10001ca0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006c2b1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10012490
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a2a10
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x100d00b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x48], 0
call fcn.1000e7b0
push eax
lea edx, [esi + 0x48]
lea ecx, [ebp - 0x40]
call fcn.10013cc0
push 0x100bb6e4
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.1000e020
add esp, 8
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x1001250d
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.10001ca0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
mov dword [ebp - 0x44], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x100125b1
push 0
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 0x10]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0x10
lea edx, [ebp - 0x28]
mov dword [edi + 0x14], 0xf
cmovae edx, dword [ebp - 0x28]
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp byte [edx], 0
jne 0x1001258e
xor ecx, ecx
jmp 0x1001259c
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10012593
sub ecx, esi
push ecx
push edx
mov ecx, edi
call fcn.100017d0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x100125f8
inc ecx
push ecx
jmp 0x100125ed
mov dword [edi + 0x14], 0xf
xor ecx, ecx
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp byte [0], cl
je 0x100125d9
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100125d0
sub ecx, edx
push ecx
push 0
mov ecx, edi
call fcn.100017d0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x100125f8
inc eax
push eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.10001ca0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006c2b1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10012950
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a2a88
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x100d00b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x74]
mov esi, dword [ebp + 0xc]
push 0x40
push 0
push eax
mov dword [ebp - 0x78], 0x44
call fcn.1006fa30
add esp, 0xc
mov dword [ebp - 0x14], 0xf
cmp byte [edi], 0
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jne 0x100129b3
xor ecx, ecx
jmp 0x100129c1
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100129b8
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.100017d0
mov ecx, esi
mov dword [ebp - 4], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100129d7
sub ecx, edx
je 0x10012a13
push 1
push 0x100bb4d4
lea ecx, [ebp - 0x28]
call fcn.10001a00
cmp byte [esi], 0
jne 0x100129fa
xor ecx, ecx
jmp 0x10012a09
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10012a00
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.10001a00
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x4c], 1
push ecx
push 0
push 0
push 0x10
push 0
mov eax, 1
mov word [ebp - 0x48], ax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [ebp - 0x14]
test eax, eax
setne bl
cmp ecx, 0x10
jb 0x10012a68
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.10001ca0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006c2b1
mov esp, ebp
pop ebp
ret 8

Function at 0x10012a90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a2ab8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x100d00b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10012ac0
sub ecx, edx
je 0x10012b43
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
push dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x18]
call fcn.1000fc70
test al, al
mov eax, dword [ebp - 0x18]
je 0x10012b26
test eax, eax
je 0x10012b03
push eax
call fcn.1006c2fa
add esp, 4
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10012b59
push eax
call fcn.1006c2fa
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
je 0x10012b33
push eax
call fcn.1006c2fa
add esp, 4
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10012b43
push eax
call fcn.1006c2fa
add esp, 4
push 3
push 0
push 0
push dword [ebp + 8]
push 0x100bb86c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10012cd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a2b28
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x100d00b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
push 1
push 0x100bb874
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.100017d0
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x48]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x28]
call fcn.10001b30
push 0xa
push str.pin.exe_
lea ecx, [ebp - 0x28]
call fcn.10001a00
push 1
push 0x100bb874
lea ecx, [ebp - 0x28]
call fcn.10001a00
cmp byte [edi], 0
jne 0x10012d5e
xor ecx, ecx
jmp 0x10012d6c
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10012d63
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.10001a00
push 1
push 0x100bb874
lea ecx, [ebp - 0x28]
call fcn.10001a00
cmp byte [ebp + 8], 0
lea ecx, [ebp - 0x28]
push 5
je 0x10012d97
push str._5386
jmp 0x10012d9c
push str._5387
call fcn.10001a00
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x10012dca
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.10001ca0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006c2b1
mov esp, ebp
pop ebp
ret 8
Function at 0x10012df0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a2b5e
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x100d00b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x44], ebx
mov eax, dword fs:[0x2c]
mov edx, dword [0x100ff5d4]
mov edi, dword [ebp + 8]
mov edx, dword [eax + edx*4]
mov eax, dword [0x1010596c]
cmp eax, dword [edx + 4]
jle 0x10012e87
push 0x1010596c
call fcn.1006c45f
add esp, 4
cmp dword [0x1010596c], 0xffffffff
jne 0x10012e87
push 0x100a3cc0
mov dword [0x10105848], 0xf
mov dword [0x10105844], 0
mov byte [0x10105834], 0
call fcn.1006c89b
push 0x1010596c
call fcn.1006c420
add esp, 8
push 0x100bb1b8
lea edx, [ebx + 0x60]
lea ecx, [ebp - 0x40]
call fcn.10013cc0
add esp, 4
mov esi, eax
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.1000e020
add esp, 4
mov ebx, eax
mov esi, 0x10105834
cmp ebx, esi
je 0x10012eff
mov eax, dword [0x10105848]
cmp eax, 0x10
jb 0x10012edc
inc eax
mov ecx, esi
push eax
push dword [0x10105834]
call fcn.10001ca0
push ebx
mov ecx, esi
mov dword [0x10105848], 0xf
mov dword [0x10105844], 0
mov byte [0x10105834], 0
call fcn.10001c30
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x10012f14
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.10001ca0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp eax, 0x10
jb 0x10012f42
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.10001ca0
cmp dword [0x10105848], 0x10
mov eax, esi
push 0
cmovae eax, dword [0x10105834]
push eax
push edi
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x10012f94
mov ecx, dword [ebp - 0x44]
push 0x10105834
sub ecx, 0xffffff80
call fcn.10013120
cmp dword [0x10105848], 0x10
cmovae esi, dword [0x10105834]
mov eax, esi
jmp 0x10012fb9
cmp dword [0x10105848], 0x10
cmovae esi, dword [0x10105834]
push esi
push edi
push str.GenerateExeIcon_failed___s__s_n
call fcn.1000e190
push eax
call fcn.1000b0b0
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006c2b1
mov esp, ebp
pop ebp
ret 4

Function at 0x10014050
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0x10]
push 0x10014030
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
pop ebp
ret 0x10
Function at 0x100140b0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
test esi, esi
je 0x10014260
test ebx, ebx
je 0x10014260
mov eax, 0xaaaaaaab
mul ebx
push edi
mov edi, edx
shr edi, 1
lea eax, [edi + edi*2]
sub ebx, eax
lea ecx, [edi*4]
lea eax, [ecx + 4]
mov dword [ebp - 4], ebx
cmove eax, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], eax
test ecx, ecx
jne 0x10014103
cmp dword [ebp + 0xc], ecx
jne 0x10014108
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0xc], eax
jae 0x10014111
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x100141b2
nop dword [eax]
mov dl, byte [esi]
mov bl, byte [esi + 1]
mov al, dl
sar al, 2
and al, 0x3f
cmp al, 0x40
jae 0x1001413b
movsx eax, al
mov al, byte [eax + 0x100ba638]
jmp 0x1001413d
or al, 0xff
mov byte [ecx], al
and dl, 3
mov al, bl
shl dl, 4
sar al, 4
and al, 0xf
or al, dl
cmp al, 0x40
jae 0x1001415d
movsx eax, al
mov al, byte [eax + 0x100ba638]
jmp 0x1001415f
or al, 0xff
mov byte [ecx + 1], al
and bl, 0xf
mov dl, byte [esi + 2]
add esi, 3
mov al, dl
shl bl, 2
sar al, 6
and al, 3
or al, bl
cmp al, 0x40
jae 0x10014186
movsx eax, al
mov al, byte [eax + 0x100ba638]
jmp 0x10014188
or al, 0xff
and dl, 0x3f
mov byte [ecx + 2], al
cmp dl, 0x40
jae 0x1001419e
movsx eax, dl
mov al, byte [eax + 0x100ba638]
jmp 0x100141a0
or al, 0xff
mov byte [ecx + 3], al
add ecx, 4
sub edi, 1
jne 0x10014120
mov ebx, dword [ebp - 4]
sub ebx, 1
je 0x10014222
sub ebx, 1
jne 0x10014256
mov bl, byte [esi]
mov dl, byte [esi + 1]
mov al, bl
sar al, 2
and al, 0x3f
cmp al, 0x40
jae 0x100141db
movsx eax, al
mov al, byte [eax + 0x100ba638]
jmp 0x100141dd
or al, 0xff
mov byte [ecx], al
and bl, 3
mov al, dl
shl bl, 4
sar al, 4
and al, 0xf
or al, bl
cmp al, 0x40
jae 0x100141fd
movsx eax, al
mov al, byte [eax + 0x100ba638]
jmp 0x100141ff
or al, 0xff
mov byte [ecx + 1], al
and dl, 0xf
shl dl, 2
movzx eax, dl
pop edi
pop esi
pop ebx
mov al, byte [eax + 0x100ba638]
mov byte [ecx + 2], al
mov eax, dword [ebp - 8]
mov byte [ecx + 3], 0x3d
mov esp, ebp
pop ebp
ret
mov dl, byte [esi]
mov al, dl
sar al, 2
and al, 0x3f
cmp al, 0x40
jae 0x1001423a
movsx eax, al
mov al, byte [eax + 0x100ba638]
jmp 0x1001423c
or al, 0xff
mov byte [ecx], al
and dl, 3
shl dl, 4
movzx eax, dl
mov al, byte [eax + 0x100ba638]
mov byte [ecx + 1], al
mov word [ecx + 2], 0x3d3d
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret