joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1021b670
Capabilities:
Get geographical location

Disassembly:
push ebx
mov eax, dword [0x1024b5e8]
push esi
test eax, eax
push edi
push ebp
jne 0x1021b6b8
push 0
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
push 1
push 0
call esi
test eax, eax
je 0x1021b698
mov eax, 2
jmp 0x1021b6be
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1021b6b1
mov eax, 1
jmp 0x1021b6be
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [0x1024b5e8], eax
cmp eax, 2
jne 0x1021b6e3
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov ebx, dword [esp + 0x18]
push ecx
push edx
push ebx
call esi
pop ebp
pop edi
pop esi
pop ebx
ret
mov dword [0x1024b5e8], eax
cmp eax, 1
jne 0x1021b77f
mov edi, dword [esp + 0x24]
test edi, edi
jne 0x1021b6ff
mov edi, dword [0x1024ad48]
mov eax, dword [esp + 0x18]
push 0
mov ebx, dword [esp + 0x18]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebp, eax
test ebp, ebp
jne 0x1021b720
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
lea eax, [ebp*2]
push eax
call sym.MSVCRT40.dll_malloc
add esp, 4
mov esi, eax
test esi, esi
jne 0x1021b73d
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [esp + 0x18]
push ebp
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1021b774
mov eax, dword [esp + 0x20]
push 0
push 0
test eax, eax
jne 0x1021b784
push 0
push 0
push 0xffffffffffffffff
push esi
push 0x220
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x1021b79f
push esi
call sym.MSVCRT40.dll_free
add esp, 4
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
push eax
mov eax, dword [esp + 0x28]
push eax
push 0xffffffffffffffff
push esi
push 0x220
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x1021b774
push esi
call sym.MSVCRT40.dll_free
add esp, 4
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x102241a0
Capabilities:
Get disk size

Disassembly:
mov eax, dword [esp + 4]
sub esp, 4
test eax, eax
jne 0x102241af
xor edx, edx
jmp 0x102241d6
cmp eax, 0x1a
jbe 0x102241bd
mov eax, 0x57
add esp, 4
ret
lea edx, [esp]
add al, 0x40
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0x5c
mov byte [esp + 3], 0
mov byte [esp], al
mov ecx, dword [esp + 0xc]
push ecx
lea eax, [ecx + 4]
push eax
lea eax, [ecx + 0xc]
add ecx, 8
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x102241fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 4
ret
xor eax, eax
add esp, 4
ret

Function at 0x10224700
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10224725
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.102155c0
add esp, 4
mov eax, 0xffffffff
ret
test al, 1
je 0x1022474c
test byte [esp + 8], 2
je 0x1022474c
call sym.MSVCRT40.dll__errno
mov dword [eax], 0xd
call sym.MSVCRT40.dll___doserrno
mov dword [eax], 5
mov eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x10224750
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10c
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x102247d9
lea eax, [esp + 4]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x102247d9
cmp byte [esp + 4], 0x5c
je 0x10224787
cmp byte [esp + 4], 0x2f
jne 0x1022479a
mov al, byte [esp + 5]
cmp byte [esp + 4], al
jne 0x1022479a
xor eax, eax
add esp, 0x10c
ret
mov byte [esp], 0x3d
xor eax, eax
mov al, byte [esp + 4]
push eax
call sym.MSVCRT40.dll__mbctoupper
lea ecx, [esp + 8]
mov byte [esp + 5], al
mov byte [esp + 6], 0x3a
mov byte [esp + 7], 0
lea edx, [esp + 4]
add esp, 4
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x102247d9
xor eax, eax
add esp, 0x10c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.102155c0
add esp, 4
mov eax, 0xffffffff
add esp, 0x10c
ret

Function at 0x10224800
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x10224836
cmp byte [esp + 5], 0x3a
jne 0x10224836
xor eax, eax
mov al, byte [esp + 4]
push eax
call sym.MSVCRT40.dll_toupper
add esp, 4
lea esi, [eax - 0x40]
mov eax, esi
pop esi
add esp, 0x104
ret
Function at 0x10224840
Capabilities:
Set current directory

Disassembly:
sub esp, 4
push ebx
mov ebx, dword [esp + 0xc]
cmp ebx, 1
jl 0x102248b0
cmp ebx, 0x1f
jg 0x102248b0
push 0xc
add bl, 0x40
call fcn.10213ba0
mov byte [esp + 9], 0x3a
mov byte [esp + 0xa], 0
mov byte [esp + 8], bl
lea ebx, [esp + 8]
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x1022488d
push 0xc
call fcn.10213c10
add esp, 4
xor eax, eax
pop ebx
add esp, 4
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.102155c0
add esp, 4
push 0xc
call fcn.10213c10
add esp, 4
mov eax, 0xffffffff
pop ebx
add esp, 4
ret
call sym.MSVCRT40.dll__errno
mov dword [eax], 0xd
call sym.MSVCRT40.dll___doserrno
pop ebx
mov dword [eax], 0xf
mov eax, 0xffffffff
add esp, 4
ret

Function at 0x102248d0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x102248f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.102155c0
add esp, 4
mov eax, 0xffffffff
pop esi
ret
test byte [esp + 0xc], 0x80
je 0x10224903
and eax, 0xfffffffe
jmp 0x10224906
or eax, 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x10224928
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.102155c0
add esp, 4
mov eax, 0xffffffff
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x10224a60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
push ebx
push esi
mov ebx, dword [esp + 0x118]
push edi
test ebx, ebx
je 0x10224ad5
push ebx
call fcn.10224ba0
add esp, 4
test eax, eax
jne 0x10224aa3
call sym.MSVCRT40.dll___doserrno
mov dword [eax], 0xf
call sym.MSVCRT40.dll__errno
pop edi
mov dword [eax], 0xd
xor eax, eax
pop esi
pop ebx
add esp, 0x10c
ret
add bl, 0x40
lea eax, [esp + 0x10]
mov byte [esp + 0xc], bl
push eax
lea ecx, [esp + 0x18]
lea ebx, [esp + 0x10]
mov byte [esp + 0x11], 0x3a
mov byte [esp + 0x12], 0x2e
mov byte [esp + 0x13], 0
push ecx
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x10224ae5
lea eax, [esp + 0x14]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x10224b86
inc eax
cmp eax, 0x104
ja 0x10224b86
mov edx, dword [esp + 0x120]
test edx, edx
jne 0x10224b37
mov ecx, dword [esp + 0x124]
cmp eax, ecx
jg 0x10224b11
mov eax, ecx
push eax
call sym.MSVCRT40.dll_malloc
add esp, 4
mov edx, eax
test edx, edx
jne 0x10224b57
call sym.MSVCRT40.dll__errno
pop edi
mov dword [eax], 0xc
xor eax, eax
pop esi
pop ebx
add esp, 0x10c
ret
cmp eax, dword [esp + 0x124]
jle 0x10224b57
call sym.MSVCRT40.dll__errno
pop edi
mov dword [eax], 0x22
xor eax, eax
pop esi
pop ebx
add esp, 0x10c
ret
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, edx
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
Function at 0x10224ba0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
sub esp, 4
test eax, eax
jne 0x10224bb4
mov eax, 1
add esp, 4
ret
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0x5c
mov byte [esp + 3], 0
add al, 0x40
mov byte [esp], al
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x10224be6
cmp eax, 1
je 0x10224be6
mov eax, 1
add esp, 4
ret
xor eax, eax
add esp, 4
ret

Function at 0x10224c00
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov eax, 0
jne 0x10224c1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10224c2f
push eax
call fcn.102155c0
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x10224c40
Capabilities:
Delete directory

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
mov eax, 0
jne 0x10224c5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10224c6d
push eax
call fcn.102155c0
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x102255d0
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
mov eax, 0
jne 0x102255ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x102255fd
push eax
call fcn.102155c0
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x10225610
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10225635
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.102155c0
add esp, 4
mov eax, 0xffffffff
ret
test al, 1
je 0x1022565c
test byte [esp + 8], 2
je 0x1022565c
call sym.MSVCRT40.dll__errno
mov dword [eax], 0xd
call sym.MSVCRT40.dll___doserrno
mov dword [eax], 5
mov eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x10225660
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x214
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x102256f2
lea eax, [esp + 8]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x102256f2
cmp word [esp + 8], 0x5c
je 0x10225699
cmp word [esp + 8], 0x2f
jne 0x102256ae
mov ax, word [esp + 8]
cmp word [esp + 0xa], ax
jne 0x102256ae
xor eax, eax
add esp, 0x214
ret
mov word [esp], 0x3d
mov eax, dword [esp + 8]
push eax
call sym.MSVCRT40.dll_towupper
mov word [esp + 6], ax
lea ecx, [esp + 4]
lea eax, [esp + 0xc]
add esp, 4
mov word [esp + 4], 0x3a
mov word [esp + 6], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x102256f2
xor eax, eax
add esp, 0x214
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.102155c0
add esp, 4
mov eax, 0xffffffff
add esp, 0x214
ret

Function at 0x10225710
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10225737
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.102155c0
add esp, 4
mov eax, 0xffffffff
pop esi
ret
test byte [esp + 0xc], 0x80
je 0x10225743
and eax, 0xfffffffe
jmp 0x10225746
or eax, 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x10225768
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.102155c0
add esp, 4
mov eax, 0xffffffff
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x102258a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
push esi
mov esi, dword [esp + 0x21c]
test esi, esi
je 0x10225919
push esi
call fcn.10224ba0
add esp, 4
test eax, eax
jne 0x102258df
call sym.MSVCRT40.dll___doserrno
mov dword [eax], 0xf
call sym.MSVCRT40.dll__errno
pop esi
mov dword [eax], 0xd
xor eax, eax
add esp, 0x214
ret
add si, 0x40
lea eax, [esp + 0xc]
mov word [esp + 4], si
push eax
lea ecx, [esp + 0x14]
lea esi, [esp + 8]
mov word [esp + 0xa], 0x3a
mov word [esp + 0xc], 0x2e
mov word [esp + 0xe], 0
push ecx
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
jmp 0x10225929
lea eax, [esp + 0x10]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x102259a7
inc eax
cmp eax, 0x104
ja 0x102259a7
mov ecx, dword [esp + 0x220]
test ecx, ecx
jne 0x10225973
mov ecx, dword [esp + 0x224]
cmp eax, ecx
jg 0x1022594d
mov eax, ecx
add eax, eax
push eax
call sym.MSVCRT40.dll_malloc
add esp, 4
mov ecx, eax
test ecx, ecx
jne 0x10225991
call sym.MSVCRT40.dll__errno
pop esi
mov dword [eax], 0xc
xor eax, eax
add esp, 0x214
ret
cmp eax, dword [esp + 0x224]
jle 0x10225991
call sym.MSVCRT40.dll__errno
pop esi
mov dword [eax], 0x22
xor eax, eax
add esp, 0x214
ret
lea eax, [esp + 0x10]
push eax
push ecx
call sym.MSVCRT40.dll_wcscpy
add esp, 8
pop esi
add esp, 0x214
ret
xor eax, eax
pop esi
add esp, 0x214
ret

Function at 0x102259c0
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
mov eax, 0
jne 0x102259dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x102259ef
push eax
call fcn.102155c0
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x10225a00
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
mov eax, 0
jne 0x10225a1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10225a2d
push eax
call fcn.102155c0
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x10225a40
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
mov eax, 0
jne 0x10225a5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10225a72
push eax
call fcn.102155c0
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x10225a80
Capabilities:
Delete directory

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
mov eax, 0
jne 0x10225a9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10225aad
push eax
call fcn.102155c0
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x10226430
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
mov eax, 0
jne 0x1022644f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10226462
push eax
call fcn.102155c0
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x1022a7f0
Capabilities:
Create pipe

Disassembly:
sub esp, 0x14
xor eax, eax
mov dword [esp + 0xc], eax
push ebx
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x28]
push edi
mov dword [esp + 0x14], 0xc
test esi, 0x80
jne 0x1022a81c
mov dword [esp + 0x1c], 1
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x1022a855
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.102155c0
add esp, 4
mov eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x14
ret
call fcn.10216960
cmp eax, 0xffffffff
mov edi, dword [esp + 0x24]
mov ecx, eax
mov dword [edi], eax
je 0x1022a967
and eax, 0xffffffe7
and ecx, 0x1f
sar eax, 3
shl ecx, 2
mov edx, dword [eax + 0x1024db00]
lea eax, [ecx + ecx*8]
mov byte [edx + eax + 4], 0x89
call fcn.10216960
cmp eax, 0xffffffff
mov ecx, eax
mov dword [edi + 4], eax
je 0x1022a931
and eax, 0xffffffe7
and ecx, 0x1f
sar eax, 3
shl ecx, 2
mov edx, dword [eax + 0x1024db00]
lea eax, [ecx + ecx*8]
test esi, 0x8000
mov byte [edx + eax + 4], 0x89
je 0x1022a8f7
mov ecx, dword [edi]
mov eax, ecx
and ecx, 0x1f
shl ecx, 2
and eax, 0xffffffe7
sar eax, 3
mov edx, dword [eax + 0x1024db00]
lea eax, [ecx + ecx*8]
and byte [edx + eax + 4], 0x7f
mov ecx, dword [edi + 4]
mov eax, ecx
and ecx, 0x1f
shl ecx, 2
and eax, 0xffffffe7
sar eax, 3
mov edx, dword [eax + 0x1024db00]
lea eax, [ecx + ecx*8]
and byte [edx + eax + 4], 0x7f
mov eax, dword [esp + 0xc]
mov ecx, dword [edi]
push eax
push ecx
call fcn.10216aa0
mov ecx, dword [esp + 0x18]
add esp, 8
mov edx, dword [edi + 4]
push ecx
push edx
call fcn.10216aa0
add esp, 8
call sym.MSVCRT40.dll__errno
mov dword [eax], 0
mov ecx, dword [edi + 4]
push ecx
call fcn.10216d70
add esp, 4
jmp 0x1022a95a
mov ecx, dword [edi]
mov eax, ecx
and ecx, 0x1f
shl ecx, 2
and eax, 0xffffffe7
sar eax, 3
mov edx, dword [eax + 0x1024db00]
lea eax, [ecx + ecx*8]
mov byte [edx + eax + 4], 0
call sym.MSVCRT40.dll__errno
mov dword [eax], 0x18
mov eax, dword [edi]
push eax
call fcn.10216d70
add esp, 4
jmp 0x1022a972
call sym.MSVCRT40.dll__errno
mov dword [eax], 0x18
call sym.MSVCRT40.dll__errno
cmp dword [eax], 0
je 0x1022a9a7
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
call sym.MSVCRT40.dll___doserrno
pop edi
mov dword [eax], 0
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x14
ret
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x10237df0
Capabilities:
Timestomp file

Disassembly:
sub esp, 0x30
push ebx
push esi
mov esi, dword [esp + 0x40]
push edi
test esi, esi
jne 0x10237e17
lea eax, [esp + 0x20]
push eax
call sym.MSVCRT40.dll_time
mov eax, dword [esp + 0x24]
lea esi, [esp + 0x20]
mov dword [esp + 0x20], eax
add esp, 4
lea eax, [esi + 4]
push eax
call sym.MSVCRT40.dll_localtime
add esp, 4
test eax, eax
jne 0x10237e3e
call sym.MSVCRT40.dll__errno
pop edi
mov dword [eax], 0x16
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x30
ret
mov ecx, dword [eax + 0x14]
add cx, 0x76c
mov word [esp + 0xc], cx
mov ecx, dword [eax + 0x10]
inc cx
mov word [esp + 0xe], cx
mov edx, dword [eax + 0xc]
mov word [esp + 0x12], dx
mov ebx, dword [eax + 8]
lea edx, [esp + 0x24]
mov word [esp + 0x14], bx
push edx
mov ecx, dword [eax + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov word [esp + 0x1a], cx
lea ecx, [esp + 0x10]
mov eax, dword [eax]
push ecx
mov word [esp + 0x22], 0
mov word [esp + 0x20], ax
call ebx
test eax, eax
je 0x10237f8b
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x24]
push eax
mov edi, dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
push ecx
call edi
test eax, eax
je 0x10237f8b
push esi
call sym.MSVCRT40.dll_localtime
add esp, 4
test eax, eax
jne 0x10237ed3
call sym.MSVCRT40.dll__errno
pop edi
mov dword [eax], 0x16
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x30
ret
mov ecx, dword [eax + 0x14]
add cx, 0x76c
mov word [esp + 0xc], cx
mov ecx, dword [eax + 0x10]
inc cx
mov word [esp + 0xe], cx
mov edx, dword [eax + 0xc]
mov word [esp + 0x12], dx
mov esi, dword [eax + 8]
lea edx, [esp + 0x24]
mov word [esp + 0x14], si
push edx
mov ecx, dword [eax + 4]
mov word [esp + 0x1a], cx
lea ecx, [esp + 0x10]
mov eax, dword [eax]
push ecx
mov word [esp + 0x22], 0
mov word [esp + 0x20], ax
call ebx
test eax, eax
je 0x10237f74
lea eax, [esp + 0x34]
lea ecx, [esp + 0x24]
push eax
push ecx
call edi
test eax, eax
je 0x10237f74
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x34]
mov edx, dword [esp + 0x40]
push eax
push ecx
push 0
push edx
call sym.MSVCRT40.dll__get_osfhandle
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x10237f6b
call sym.MSVCRT40.dll__errno
pop edi
mov dword [eax], 0x16
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x30
ret
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x30
ret
call sym.MSVCRT40.dll__errno
pop edi
mov dword [eax], 0x16
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x30
ret
call sym.MSVCRT40.dll__errno
pop edi
mov dword [eax], 0x16
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x1023b1e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ebx, dword [esp + 0x14]
lea edi, [esi + 4]
test ebx, ebx
jle 0x1023b226
add esi, 8
push 3
mov eax, dword [edi]
and eax, 0x3800
shr eax, 0xb
push eax
push esi
call fcn.1023b380
add esp, 0xc
mov eax, dword [edi]
lea ecx, [eax + 0x800]
xor ecx, eax
and ecx, 0x3800
xor ecx, eax
dec ebx
mov dword [edi], ecx
jne 0x1023b1f5
pop edi
pop esi
pop ebx
ret
jge 0x1023b252
mov ecx, dword [edi]
push 0
lea eax, [ecx - 0x800]
xor eax, ecx
add esi, 8
and eax, 0x3800
xor eax, ecx
mov dword [edi], eax
and eax, 0x3800
shr eax, 0xb
push eax
push esi
call fcn.1023b380
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4027f7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
test esi, esi
jg 0x402819
jl 0x402810
test ebx, ebx
jne 0x402819
xor eax, eax
xor edx, edx
jmp 0x4028de
cmp dword [ecx + 0x38], 0
je 0x40282e
push esi
push ebx
push dword [ebp + 8]
call fcn.00402dda
jmp 0x4028de
mov eax, dword [ecx + 0x1c]
push edi
mov edi, ebx
mov edx, dword [eax]
test edx, edx
je 0x402872
mov eax, dword [ecx + 0x2c]
cmp dword [eax], 0
jbe 0x402872
cmp dword [eax], ebx
mov esi, ebx
mov edi, dword [ebp + 8]
cmovb esi, dword [eax]
push esi
push edx
push edi
call fcn.004061e0
mov ecx, dword [ebp - 4]
add edi, esi
mov dword [ebp + 8], edi
add esp, 0xc
mov edi, ebx
sub edi, esi
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0x10]
jmp 0x402878
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
cmp dword [ecx + 0x4c], 0
je 0x4028d4
call fcn.00403608
mov edx, dword [ebp + 8]
mov eax, edi
cmp edi, 0xfff
jbe 0x4028bf
push dword [ecx + 0x4c]
push 0xfff
push 1
push edx
call fcn.0040c480
mov edx, dword [ebp + 8]
mov ecx, 0xfff
add edx, eax
add esp, 0x10
sub edi, eax
mov dword [ebp + 8], edx
cmp eax, ecx
jne 0x4028d4
cmp edi, ecx
mov ecx, dword [ebp - 4]
ja 0x402890
mov eax, edi
test eax, eax
je 0x4028d4
push dword [ecx + 0x4c]
push edi
push 1
push edx
call fcn.0040c480
add esp, 0x10
sub edi, eax
sub ebx, edi
mov eax, ebx
sbb esi, 0
mov edx, esi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x403b2c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x421d65
call fcn.00421b24
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
call fcn.00404d5b
mov esi, eax
push 1
mov dword [ebp - 4], ebx
call fcn.00404449
pop ecx
pop ecx
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.00403aca
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4057da
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x405819
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405819
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405819
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405819
cmp dword [ecx + 0x74], 0xe
jbe 0x405819
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret