joyce8/EMBER2024-capa huggingface dataset:
Function at 0x78155e6a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78155e97
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll__mbscat_s_l
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78155eb5
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78155e92
test byte [esp + 0xc], 0x80
je 0x78155ec1
and eax, 0xfffffffe
jmp 0x78155ec4
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
je 0x78155ea6
xor eax, eax
pop esi
ret

Function at 0x7816707b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x7816708a
pop dword [ebp - 0x18]
mov eax, 0x7816708a
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x402b2
push 0
mov eax, 0xaabd7fe7
sub eax, 0x32a43f27
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x3f8a
xor edi, edi
add edi, eax
mov esi, 0x98a9c790
add esi, 0xdf72e870
add esi, dword [ebp - 0x18]
mov ebx, 0x38309576
sub ebx, 0xb71a0827
sub dword [ebp - 0x10], 0x1d051a57
mov edx, dword [esi]
add dword [ebp - 0xc], 0x3737814d
xor edx, ebx
xor dword [ebp - 0xc], eax
mov dword [edi], edx
xor dword [ebp - 8], eax
add edi, 0x3b25a471
sub edi, 0x3b25a46d
add esi, 0x2b7b5d0e
sub esi, 0x2b7b5d0a
loop 0x781670e0
add eax, 0xa0e84520
add eax, 0x5f18abdb
mov ebx, eax
add eax, 0x3b423eae
sub eax, 0x3b423ea9
mov ecx, 0x5cbd456e
add ecx, 0x1b55ba92
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10001a4b
Capabilities:
Hash data with md5

Disassembly:
jmp 0x100a2870
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov eax, 1
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
ret

Function at 0x10001a8c
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x100ac410
mov eax, dword [0x100f4074]
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 0xffffffff
je 0x100ac42b
push eax
call esi
test eax, eax
jne 0x100ac441
call fcn.100adad0
mov eax, dword [0x100f4074]
cmp eax, 0xffffffff
jne 0x100ac43e
xor eax, eax
jmp 0x100ac441
push eax
call esi
lea esi, [eax + 0x14]
lea eax, [esp + 0x10]
mov ecx, esi
push eax
lea eax, [esp + 8]
push eax
call fcn.100011e0
push dword [esp + 8]
lea eax, [esp + 8]
mov ecx, esi
push dword [esp + 8]
push eax
call fcn.10004de0
pop esi
add esp, 8
ret

Function at 0x100026da
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x10016d10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100f9aec]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100f9054]
cmp eax, dword [ecx + 0x104]
jg 0x10016d32
mov eax, 0x100f9050
ret
push 0x100f9054
call fcn.10001951
add esp, 4
cmp dword [0x100f9054], 0xffffffff
jne 0x10016d2c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0x10004db3
mov dword [0x100f9050], eax
call fcn.100023b0
push 0x100f9054
call fcn.10002568
add esp, 8
jmp 0x10016d2c

Function at 0x10002b12
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x100ae630
jmp fcn.100aea90

Function at 0x10003062
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x10059360
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x10059375
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.10059087
scasb al, byte es:[edi]
ret 0x5940

Function at 0x1000369d
Capabilities:
Create udp socket

Disassembly:
jmp 0x10094e30
mov ecx, dword [0x100f4068]
cmp ecx, 0xffffffff
jne 0x10094e77
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x10094e5c
xor ecx, ecx
xor eax, eax
test ecx, ecx
mov dword [0x100f4068], ecx
setg al
ret
push eax
push 0
mov dword [0x100f4068], 1
call fcn.10004115
mov ecx, dword [0x100f4068]
add esp, 8
xor eax, eax
test ecx, ecx
setg al
ret
Function at 0x10004647
Capabilities:
Create thread
Resume thread

Disassembly:
jmp 0x100aefc0
push ebx
push edi
mov edi, ecx
mov edx, dword [edi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x100af300
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x100aefea
pop edi
xor al, al
pop ebx
ret
mov eax, dword [edi]
push esi
add eax, 4
lock inc dword [eax]
mov esi, dword [edi]
mov eax, dword [esi + 8]
test eax, eax
je 0x100af008
cmp eax, 0xffffffff
je 0x100af008
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], ebx
mov eax, dword [edi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop edi
mov al, 1
pop ebx
ret

Function at 0x100172e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100f408c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
push esi
mov esi, dword [ebp + 0xc]
push esi
mov word [ebp - 0x1c], cx
lea ecx, [ebp - 0x1c]
push eax
mov dword [ebp - 8], 7
mov dword [ebp - 0xc], 0
call fcn.10004142
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 8]
cmp ecx, 8
jb 0x1001733e
push 2
inc ecx
push ecx
push dword [ebp - 0x1c]
call fcn.10004633
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1000432c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10022720
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b7dc6
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x100f408c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x100227d9
mov esi, dword [edi]
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call dword [esi + 0x18]
push eax
mov ecx, edi
call dword [esi + 0xc]
test eax, eax
je 0x100227e3
mov esi, dword [edi]
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call dword [esi + 0x18]
push eax
mov ecx, edi
call dword [esi + 0xc]
test eax, eax
je 0x100227d9
mov esi, dword [edi]
lea eax, [ebp - 0x218]
push 0
push eax
mov ecx, edi
call dword [esi + 0x18]
push eax
mov ecx, edi
call dword [esi + 0xc]
test eax, eax
sete al
movzx eax, al
push eax
push 0x21
push str.H:_baidu_netdiskpc_updateagent_sourcekernel_base_file_path_manager.cpp
call fcn.100021e9
add esp, 0x10
mov eax, 2
jmp 0x1002291e
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x100227d9
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x438]
call fcn.1000173f
push 0xffffffffffffffff
push 0x100cb400
lea ecx, [ebp - 0x438]
mov dword [ebp - 4], 0
call fcn.10001384
cmp eax, 0xffffffff
je 0x10022880
inc eax
lea ecx, [ebp - 0x438]
push eax
push 0
lea eax, [ebp - 0x450]
push eax
call fcn.10002f77
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x450]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x438]
call fcn.10001992
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0
call fcn.10002757
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
mov esi, dword [edi]
mov ecx, edi
cmovae eax, dword [ebp - 0x438]
push eax
call dword [esi + 0x14]
push eax
mov ecx, edi
call dword [esi + 0xc]
test eax, eax
je 0x1002290f
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
mov esi, dword [edi]
mov ecx, edi
cmovae eax, dword [ebp - 0x438]
push eax
call dword [esi + 0x14]
push eax
mov ecx, edi
call dword [esi + 0xc]
test eax, eax
je 0x10022908
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
mov esi, dword [edi]
mov ecx, edi
cmovae eax, dword [ebp - 0x438]
push 0
push eax
call dword [esi + 0x14]
push eax
mov ecx, edi
call dword [esi + 0xc]
test eax, eax
sete al
movzx eax, al
push eax
push 0x32
push str.H:_baidu_netdiskpc_updateagent_sourcekernel_base_file_path_manager.cpp
call fcn.100021e9
add esp, 0x10
mov esi, 2
jmp 0x10022911
xor esi, esi
lea ecx, [ebp - 0x438]
call fcn.10002757
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000432c
mov esp, ebp
pop ebp
ret
Function at 0x10024780
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b8178
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x100f408c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
test edi, edi
jne 0x100247cb
push edi
push edi
push 0x15
push str.H:_baidu_netdiskpc_updateagent_sourcekernelcommon_file_utils.cpp
call fcn.100021e9
add esp, 0x10
lea eax, [edi + 6]
jmp 0x10024878
push edi
lea ecx, [ebp - 0x40]
call fcn.1000173f
mov ebx, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess]
xor esi, esi
mov dword [ebp - 4], 0
push esi
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.10002f77
cmp dword [ebp - 0x18], 0
je 0x10024827
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
add esp, 8
test eax, eax
je 0x10024827
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x10024894
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x1002483e
push 2
inc eax
push eax
push dword [ebp - 0x28]
call fcn.10004633
add esp, 0xc
push 1
lea eax, [esi + 1]
mov dword [ebp - 0x44], 0x5c
push eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x40]
call fcn.1000501a
mov esi, eax
test esi, esi
jns 0x100247e3
xor esi, esi
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x10024876
push 2
inc ecx
push ecx
push dword [ebp - 0x40]
call fcn.10004633
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000432c
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push edi
push str.create_directory___s__failed__s_
push 0x40
call fcn.100024ff
mov eax, dword [ebp - 0x14]
add esp, 0x10
cmp eax, 8
jb 0x100248c7
push 2
inc eax
push eax
push dword [ebp - 0x28]
call fcn.10004633
add esp, 0xc
mov esi, 1
jmp 0x1002485f
Function at 0x10065aa0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c1058
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x100f408c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
test edi, edi
jne 0x10065af8
push edi
push edi
push 0x22
push str.H:_baidu_netdiskpc_updateagent_sourcekernelupdatedownloadupdate_download_processor.cpp
call fcn.100021e9
add esp, 0x10
mov eax, 6
jmp 0x10065c08
test ebx, ebx
jne 0x10065b02
push ebx
push ebx
push 0x23
jmp 0x10065ae1
test eax, eax
jne 0x10065b0c
push eax
push eax
push 0x24
jmp 0x10065ae1
push dword [esi + 0x1c0]
call fcn.10004791
mov ecx, dword [esi + 0x16c]
push ecx
mov dword [esi + 0x16c], eax
call fcn.100050bf
add esp, 8
cmp dword [esi + 0x16c], 0
jne 0x10065b52
push 0
push 0
push 0x27
push str.H:_baidu_netdiskpc_updateagent_sourcekernelupdatedownloadupdate_download_processor.cpp
call fcn.100021e9
add esp, 0x10
mov eax, 4
jmp 0x10065c08
push edi
lea ecx, [esi + 0x128]
call fcn.1000170d
push ebx
lea ecx, [esi + 0x140]
call fcn.1000170d
mov cl, byte [ebp + 0x10]
mov eax, dword [esi + 0x1c0]
mov byte [esi + 0x158], cl
mov dword [esi + 0x170], 0
mov dword [esi + 0x174], eax
mov word [esi + 0x178], 0
test cl, cl
je 0x10065b9f
mov ecx, esi
call fcn.1000475f
jmp 0x10065bc8
push 0
lea eax, [ebp - 0x28]
push edi
push eax
call fcn.1000174e
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 0x10
lea ecx, [ebp - 0x28]
call fcn.10003c0b
push 0
push dword [ebp - 0x44]
lea eax, [ebp - 0x40]
push eax
call fcn.1000174e
add esp, 0xc
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.10001e1f
lea ecx, [esi + 0xc]
call fcn.100036e8
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.10003c0b
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000432c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100708b0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c2bb0
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x100f408c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x4c], esi
cmp dword [esi + 0x30], 8
lea ebx, [esi + 0x1c]
mov byte [ebp - 0x41], 1
jb 0x100708f1
mov eax, dword [ebx]
jmp 0x100708f3
mov eax, ebx
lea ecx, [ebp - 0x41]
push ecx
push eax
call fcn.10003fad
add esp, 8
test eax, eax
jne 0x10070921
cmp byte [ebp - 0x41], al
jne 0x10070928
cmp dword [ebx + 0x14], 8
jb 0x10070911
mov ebx, dword [ebx]
push ebx
push str.MoveFileCommand_pre_condition_file__s__not_exist
push 0x40
call fcn.100024ff
add esp, 0xc
xor al, al
jmp 0x10070a73
cmp dword [esi + 0x74], 0
jbe 0x10070a71
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp dword [ebx + 0x14], 8
mov dword [ebp - 4], eax
jb 0x10070951
mov ebx, dword [ebx]
lea eax, [ebp - 0x28]
push eax
push ebx
call fcn.10003571
add esp, 8
mov dword [ebp - 0x2c], 7
xor ecx, ecx
mov dword [ebp - 0x30], 0
lea eax, [esi + 0x64]
mov word [ebp - 0x40], cx
push 0xffffffffffffffff
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.10001992
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x40]
mov edx, dword [ebp - 0x40]
lea edi, [ebp - 0x40]
mov eax, dword [ebp - 0x30]
cmp esi, 8
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmovae ecx, edx
mov byte [ebp - 4], 1
cmovae edi, edx
mov dword [ebp - 0x48], ebx
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x40]
cmovae ecx, edx
lea edx, [ebp - 0x48]
push edx
push edi
push eax
push ecx
call fcn.10005353
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
lea edi, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmp esi, 8
mov dword [ebp - 0x48], ebx
cmovae ecx, edx
cmovae edi, edx
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x28]
cmovae ecx, edx
lea edx, [ebp - 0x48]
push edx
push edi
push eax
push ecx
call fcn.10005353
mov edi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
push dword [ebp - 0x18]
mov ebx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp edi, 8
cmovae ecx, ebx
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push dword [ebp - 0x30]
push eax
call fcn.10003da0
add esp, 0x30
test eax, eax
je 0x10070a61
mov esi, dword [ebp - 0x4c]
cmp dword [esi + 0x78], 8
lea ecx, [esi + 0x64]
jb 0x10070a27
mov ecx, dword [ecx]
cmp edi, 8
lea edx, [ebp - 0x28]
lea eax, [esi + 0x1c]
cmovae edx, ebx
cmp dword [eax + 0x14], 8
jb 0x10070a3b
mov eax, dword [eax]
push ecx
push edx
push eax
push str.MoveFileCommand_pre_condition_file__s__md5__s__diff_from_md5__s__in_file_meta
push 0x40
call fcn.100024ff
add esp, 0x14
lea ecx, [ebp - 0x40]
call fcn.10002757
lea ecx, [ebp - 0x28]
call fcn.10002757
xor al, al
jmp 0x10070a73
lea ecx, [ebp - 0x40]
call fcn.10002757
lea ecx, [ebp - 0x28]
call fcn.10002757
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000432c
mov esp, ebp
pop ebp
ret
Function at 0x10073090
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c3031
mov eax, dword fs:[0]
push eax
sub esp, 0xd8
mov eax, dword [0x100f408c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0xcc]
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xd8], eax
lea esi, [ecx + 0x34]
lea eax, [ebp - 0xc8]
mov dword [ebp - 0xd4], 0x10001271
mov dword [ebp - 0xd0], 0x1000499e
lea edi, [ecx + 0x1c]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], 0x100049b7
mov dword [ebp - 0xdc], 0x10001758
nop
cmp dword [edi + 0x14], 8
jb 0x1007311a
mov eax, dword [edi]
jmp 0x1007311c
mov eax, edi
push str._1_.old._2_
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xcc], eax
call fcn.10002fa4
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], 0
push ecx
push eax
call fcn.100053c1
lea ecx, [ebp - 0xe4]
push ecx
push eax
call fcn.100053c1
add esp, 0x10
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
call fcn.10003fda
mov ebx, eax
cmp esi, ebx
je 0x100731a4
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x1007317d
inc eax
push 2
push eax
push dword [esi]
call fcn.10004633
add esp, 0xc
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x10073195
mov eax, dword [esi]
jmp 0x10073197
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push ebx
call fcn.10001e8d
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x100731fb
mov ecx, dword [ebp - 0x28]
inc eax
cmp eax, 0x7fffffff
ja 0x10073283
add eax, eax
cmp eax, 0x1000
jb 0x100731f2
test cl, 0x1f
jne 0x10073283
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x10073283
sub ecx, eax
cmp ecx, 4
jb 0x10073283
cmp ecx, 0x23
ja 0x10073283
mov ecx, eax
push ecx
call fcn.10001479
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 0xffffffff
call fcn.10003562
cmp dword [esi + 0x14], 8
jb 0x1007322b
mov ecx, dword [esi]
jmp 0x1007322d
mov ecx, esi
cmp dword [edi + 0x14], 8
jb 0x10073237
mov eax, dword [edi]
jmp 0x10073239
mov eax, edi
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x10073289
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp eax, 0xa
jl 0x10073110
cmp dword [edi + 0x14], 8
jb 0x10073265
mov edi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.DeleteFileCommand_execute_failed__s____s_
push 0x40
call fcn.100024ff
add esp, 0x10
mov eax, 1
jmp 0x1007328b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000432c
mov esp, ebp
pop ebp
ret
Function at 0x10074c80
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x100f408c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10074cd3
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x10074ccd
shr eax, 8
cmp al, 2
jne 0x10074ccd
call fcn.10001195
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000432c
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.1000432c
mov esp, ebp
pop ebp
ret

Function at 0x100859f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x190]
test eax, eax
je 0x10085a19
push dword [edi + 0x11c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call eax
add esp, 0x14
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x10085a51
push dword [edi + 0x118]
lea eax, [eax + eax*2]
push 1
add eax, 0x100d362c
push 2
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [edi + 0x118]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x20
xor eax, eax
pop edi
pop ebp
ret
Function at 0x10087410
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100f408c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
push 4
cmp byte [esi + 0x3f0], al
setne al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1008746d
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.1000137f
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000432c
mov esp, ebp
pop ebp
ret
push dword [esi + 0x3f4]
mov dword [ebp - 0x10], 1
call fcn.10004269
push dword [esi + 0x3f8]
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
call fcn.10004269
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x100874dd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.1000137f
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000432c
mov esp, ebp
pop ebp
ret

Function at 0x10097530
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000000
push 1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10097562
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x8003
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop esi
pop ebp
ret

Function at 0x1009dda0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x1009ddcc
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x1009ddbd
pop edi
xor eax, eax
pop esi
pop ebp
ret
push dword [eax + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call ecx
jmp 0x1009de02
cmp dword [esi + 8], 0
jne 0x1009ddf1
push 0x100d2c54
push dword [eax + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x1009ddf1
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
push dword [esi + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x1009de25
mov eax, dword [esi + 8]
test eax, eax
je 0x1009de1f
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret