joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002370
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100140f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
movzx eax, byte [esi]
dec eax
mov edi, ecx
cmp eax, 0x67
ja case.default.0x1000239c
movzx eax, byte [eax + 0x1000255c]
push ebx
jmp dword [eax*4 + 0x1000253c]
push 0x30
call fcn.100025d0
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
push 1
call fcn.100025d0
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
dec eax
push eax
lea eax, [esi + 1]
push eax
call fcn.10002290
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
jne 0x100024ed
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
jmp 0x100024ed
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
je 0x100024ed
lea eax, [ebp - 0x20]
push eax
push 1
jmp 0x100024e6
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 4
jne 0x100024ed
lea eax, [ebp - 0x20]
push eax
push 2
jmp 0x100024e6
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 7
jne 0x100024ed
lea eax, [ebp - 0x20]
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [edi + 0xc]
mov ecx, edi
call fcn.10002610
mov esi, eax
test esi, esi
je case.0x1000239c.8
push esi
call dword [sym.imp.KERNEL32.dll_LocalSize]
push eax
push esi
mov ecx, edi
call fcn.10001df0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
Function at 0x100023f8
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100140f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
movzx eax, byte [esi]
dec eax
mov edi, ecx
cmp eax, 0x67
ja case.default.0x1000239c
movzx eax, byte [eax + 0x1000255c]
push ebx
jmp dword [eax*4 + 0x1000253c]
push 0x30
call fcn.100025d0
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
push 1
call fcn.100025d0
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
dec eax
push eax
lea eax, [esi + 1]
push eax
call fcn.10002290
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
jne 0x100024ed
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
jmp 0x100024ed
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
je 0x100024ed
lea eax, [ebp - 0x20]
push eax
push 1
jmp 0x100024e6
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 4
jne 0x100024ed
lea eax, [ebp - 0x20]
push eax
push 2
jmp 0x100024e6
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 7
jne 0x100024ed
lea eax, [ebp - 0x20]
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [edi + 0xc]
mov ecx, edi
call fcn.10002610
mov esi, eax
test esi, esi
je case.0x1000239c.8
push esi
call dword [sym.imp.KERNEL32.dll_LocalSize]
push eax
push esi
mov ecx, edi
call fcn.10001df0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
Function at 0x1000243d
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100140f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
movzx eax, byte [esi]
dec eax
mov edi, ecx
cmp eax, 0x67
ja case.default.0x1000239c
movzx eax, byte [eax + 0x1000255c]
push ebx
jmp dword [eax*4 + 0x1000253c]
push 0x30
call fcn.100025d0
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
push 1
call fcn.100025d0
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
dec eax
push eax
lea eax, [esi + 1]
push eax
call fcn.10002290
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
jne 0x100024ed
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
jmp 0x100024ed
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
je 0x100024ed
lea eax, [ebp - 0x20]
push eax
push 1
jmp 0x100024e6
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 4
jne 0x100024ed
lea eax, [ebp - 0x20]
push eax
push 2
jmp 0x100024e6
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 7
jne 0x100024ed
lea eax, [ebp - 0x20]
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [edi + 0xc]
mov ecx, edi
call fcn.10002610
mov esi, eax
test esi, esi
je case.0x1000239c.8
push esi
call dword [sym.imp.KERNEL32.dll_LocalSize]
push eax
push esi
mov ecx, edi
call fcn.10001df0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
Function at 0x10002476
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100140f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
movzx eax, byte [esi]
dec eax
mov edi, ecx
cmp eax, 0x67
ja case.default.0x1000239c
movzx eax, byte [eax + 0x1000255c]
push ebx
jmp dword [eax*4 + 0x1000253c]
push 0x30
call fcn.100025d0
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
push 1
call fcn.100025d0
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
dec eax
push eax
lea eax, [esi + 1]
push eax
call fcn.10002290
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
jne 0x100024ed
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
jmp 0x100024ed
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
je 0x100024ed
lea eax, [ebp - 0x20]
push eax
push 1
jmp 0x100024e6
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 4
jne 0x100024ed
lea eax, [ebp - 0x20]
push eax
push 2
jmp 0x100024e6
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 7
jne 0x100024ed
lea eax, [ebp - 0x20]
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [edi + 0xc]
mov ecx, edi
call fcn.10002610
mov esi, eax
test esi, esi
je case.0x1000239c.8
push esi
call dword [sym.imp.KERNEL32.dll_LocalSize]
push eax
push esi
mov ecx, edi
call fcn.10001df0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
Function at 0x100024af
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100140f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
movzx eax, byte [esi]
dec eax
mov edi, ecx
cmp eax, 0x67
ja case.default.0x1000239c
movzx eax, byte [eax + 0x1000255c]
push ebx
jmp dword [eax*4 + 0x1000253c]
push 0x30
call fcn.100025d0
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
push 1
call fcn.100025d0
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
dec eax
push eax
lea eax, [esi + 1]
push eax
call fcn.10002290
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
jne 0x100024ed
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
jmp 0x100024ed
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
je 0x100024ed
lea eax, [ebp - 0x20]
push eax
push 1
jmp 0x100024e6
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 4
jne 0x100024ed
lea eax, [ebp - 0x20]
push eax
push 2
jmp 0x100024e6
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 7
jne 0x100024ed
lea eax, [ebp - 0x20]
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [edi + 0xc]
mov ecx, edi
call fcn.10002610
mov esi, eax
test esi, esi
je case.0x1000239c.8
push esi
call dword [sym.imp.KERNEL32.dll_LocalSize]
push eax
push esi
mov ecx, edi
call fcn.10001df0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10003c80
mov esp, ebp
pop ebp
ret 8
Function at 0x1000da24
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100140f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.10007a39
mov dword [ebp - 0x14], eax
cmp dword [0x10015fac], edi
jne 0x1000db15
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x1000daa2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1000dbf5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1000dbf5
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000dbf5
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x10015fac], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x10015fb0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x10015fb4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10015fbc], eax
test eax, eax
je 0x1000db12
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10015fb8], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1000db3a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1000db2d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x1000db4f
push 4
pop eax
jmp 0x1000dbf7
cmp dword [ebp - 0x14], edi
je 0x1000db4f
push dword [0x10015fac]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1000db34
mov eax, dword [0x10015fb8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x1000dbad
cmp dword [0x10015fbc], esi
je 0x1000dbad
push eax
call ebx
push dword [0x10015fbc]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1000dbad
test eax, eax
je 0x1000dbad
call ecx
test eax, eax
je 0x1000dba2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1000dba2
test byte [ebp - 8], 1
jne 0x1000dbad
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x1000dbdd
mov eax, dword [0x10015fb0]
cmp eax, esi
je 0x1000dbda
push eax
call ebx
test eax, eax
je 0x1000dbda
call eax
mov edi, eax
test edi, edi
je 0x1000dbda
mov eax, dword [0x10015fb4]
cmp eax, esi
je 0x1000dbda
push eax
call ebx
test eax, eax
je 0x1000dbda
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x10015fac]
call ebx
test eax, eax
je 0x1000dbf5
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x1000dbf7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10003c80
leave
ret
Function at 0x4210e0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
jmp 0x4210f8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1519a5
jge 0x421141
mov dword [0x2bd4334], 0x8e46a6f0
cmp dword [0x2bd46cc], 0x3dc
jne 0x42113f
xor ecx, ecx
mov word [ebp - 8], cx
xor edx, edx
mov word [ebp - 6], dx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x4210ef
mov dword [ebp - 0x10], 0
jmp 0x421153
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x12cad2a
jge 0x4211ee
cmp dword [0x2bd46cc], 0xa5f
jne 0x421174
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp dword [ebp - 0x10], 0x84620b
jne 0x421199
mov eax, dword [0x42dbf0]
mov dword [0x2bd46cc], eax
mov ecx, dword [0x2bd46cc]
add ecx, 0xa231
mov dword [0x2bd46cc], ecx
cmp dword [0x2bd46cc], 0x141
jne 0x4211e9
xor edx, edx
mov word [ebp - 0x24], dx
xor eax, eax
mov word [ebp - 0x22], ax
xor ecx, ecx
mov word [ebp - 0x20], cx
xor edx, edx
mov word [ebp - 0x1e], dx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
mov dword [0x42f1b8], 0xec58acac
mov dword [0x42f1bc], 0xffffffff
jmp 0x42114a
call fcn.00420e90
jmp dword [0x2bd224c]
Function at 0x40193e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401951
push esp
mov dword [ebp - 0x24], 0x4016b5
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019f0
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x4019d1
pop ebp
ret 0x10

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x40c279
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40c288
pop dword [ebp - 0x48]
mov eax, 0x2884a8b6
add eax, 0xd7bc19d2
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xacb8f3f1
add dword [ebp - 0x58], 0xa199515a
mov dword [ebp - 0x54], 0xd2db0fcc
sub dword [ebp - 0x54], 0xa0a7c387
mov dword [ebp - 0x50], 0x6d4b695
sub dword [ebp - 0x50], 0xba887267
mov dword [ebp - 0x4c], 0x684ab2ea
sub dword [ebp - 0x4c], 0x684ab2ea
lea eax, [ebp - 0x58]
push eax
mov eax, 0xef1ab5fa
add eax, 0x11277a7a
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x15900b92
sub dword [ebp - 0x58], 0xa11da23c
mov dword [ebp - 0x54], 0x37dc5ce0
add dword [ebp - 0x54], 0x9900495
mov dword [ebp - 0x50], 0xde9fd29a
sub dword [ebp - 0x50], 0x7b30662e
mov dword [ebp - 0x4c], 0x9b600b3d
add dword [ebp - 0x4c], 0x649ff4c3
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3def7
push 0
call eax
mov ecx, 0x3bc88c8d
sub ecx, 0x3bc8438e
mov esi, eax
mov edi, 0x732c340
add edi, 0xf91080c0
add edi, dword [ebp - 0x48]
mov edx, 0x5212e85c
add edx, 0x3d89a795
add dword [ebp - 0x24], 0x4994d9df
mov ebx, dword [edi]
sub dword [ebp - 0x28], 0x76e12338
xor ebx, edx
add dword [ebp - 0x38], ecx
mov dword [esi], ebx
add dword [ebp - 0x3c], esi
add esi, 0x998c2052
add esi, 0x6673dfb2
add edi, 4
loop 0x40c3a5
add eax, 0x116cf
mov ebx, eax
add eax, 0x36be7648
sub eax, 0x36be7643
mov ecx, 0x7d965b26
sub ecx, 0x7d565b26
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x1000b220
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1000b24c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x1000b274
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x1000b27a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x1000b2e2
jg 0x1000b291
test esi, esi
je 0x1000b2e2
test ecx, ecx
jl 0x1000b2dd
jg 0x1000b29b
test eax, eax
je 0x1000b2dd
cmp edi, ecx
jg 0x1000b2af
jl 0x1000b2a5
cmp esi, eax
jae 0x1000b2af
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x1000b2e5
mov ecx, dword [ebp + 8]
jmp 0x1000b2ef
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x1000b309
jg 0x1000b2ef
test esi, esi
je 0x1000b309
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1000b309
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc