joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70206d50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x70316848
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 8]
push 0x70359f90
push ecx
mov dword [esp + 0x14], 0x28
mov dword [esp + 0x18], 1
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
call fcn.70228650
add esp, 8
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x40], 0
mov esi, dword [esp + 8]
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], edx
call fcn.70261d00
test eax, eax
je 0x70206e02
lea eax, [esp + 0xc]
push eax
push 0
call dword [0x703597a8]
lea eax, [esi - 0x10]
mov dword [esp + 0x40], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x70206e26
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x70206e40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x70316818
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [0x703580e4]
mov edx, dword [eax + 0xc]
mov ecx, 0x703580e4
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
lea eax, [esp + 0x18]
push 0x70359f90
push eax
mov dword [esp + 0x2c], 0
call fcn.70228650
mov esi, eax
lea ecx, [esp + 0x1c]
push ecx
mov edi, 0xa0
mov byte [esp + 0x30], 1
call fcn.702278e0
add esp, 0xc
mov edx, dword [esp + 0x2c]
mov byte [esp + 0x24], 2
mov ecx, dword [esi]
mov eax, dword [eax]
push edx
push ecx
push eax
lea edi, [esp + 0x1c]
call fcn.70208e90
mov byte [esp + 0x30], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x70206eec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x24], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x70206f11
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
push ecx
call fcn.70261ef0
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x70206f46
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x7020d100
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x70314086
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x430], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x448]
mov dword fs:[0], eax
push str.whitelist.dat
push 0x70359d48
lea eax, [esp + 0x3c]
push eax
xor ebx, ebx
xor esi, esi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
xor edi, edi
mov dword [esp + 0x18], edi
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
lea ecx, [esp + 0x4c]
push ecx
mov dword [esp + 0x46c], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x7020d265
call fcn.7020df50
cmp eax, ebx
jne 0x7020d30c
push ebx
lea edx, [esp + 0x18]
push edx
push 0x10
lea eax, [esp + 0x30]
push eax
push edi
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
jne 0x7020d270
call fcn.7020df50
cmp eax, ebx
jne 0x7020d301
mov esi, 0x70354bb0
call fcn.7020d930
cmp dword [esp + 0x24], 0x4c573351
mov dword [esp + 0x1c], 1
jne 0x7020d2fd
mov eax, dword [esp + 0x2c]
cmp eax, 2
ja 0x7020d2fd
mov dword [0x70354bbc], eax
cmp dword [esp + 0x30], ebx
jbe 0x7020d2fd
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
mov dword [esp + 0x24], ebx
call fcn.702df932
mov ebp, eax
add esp, 4
lea esi, [ebx - 0x10]
mov ecx, ebp
lea edx, [esp + 0x18]
call fcn.7020df10
test eax, eax
jne 0x7020d2f4
mov dword [esp + 0x14], 0x4c573351
test ebp, ebp
je 0x7020d257
lea ecx, [esp + 0x14]
test esi, esi
jbe 0x7020d257
mov edi, edi
lea edx, [esp + 0x18]
cmp ecx, edx
jne 0x7020d24c
lea ecx, [esp + 0x14]
mov dl, byte [ecx]
xor byte [eax + ebp], dl
inc eax
inc ecx
cmp eax, esi
jb 0x7020d240
cmp dword [ebp], 0
mov edi, ebp
jbe 0x7020d2f0
jmp 0x7020d284
mov dword [esp + 0x18], eax
mov edi, eax
jmp 0x7020d192
cmp dword [esp + 0x14], 0x10
jmp 0x7020d1b9
mov ebx, dword [esp + 0x20]
cmp dword [edi], ebx
jae 0x7020d2f0
lea eax, [edi + 4]
mov edx, 0x208
lea ecx, [esp + 0x23c]
call fcn.7020dec0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x240]
call fcn.7020de30
mov ebx, eax
mov esi, 0x70354bb0
mov byte [esp + 0x450], 1
call fcn.7020d8c0
mov byte [esp + 0x450], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x7020d2e9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add edi, dword [edi]
cmp dword [edi], 0
ja 0x7020d280
mov edi, dword [esp + 0x18]
push ebp
call fcn.702e1ea6
add esp, 4
mov esi, dword [esp + 0x1c]
test edi, edi
je 0x7020d30c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [esp + 0x448]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x440
ret
Function at 0x7020dbe0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x7020dbf7
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x7020dc28
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x7020dc24
cmp esi, eax
jae 0x7020dc28
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x7020dc14
cmp esi, eax
jb 0x7020dc2e
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x7020e020
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x540
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x53c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 4]
push ecx
push 0x320
lea edx, [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x10], eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
jne 0x7020e06c
mov ecx, dword [esp + 0x53c]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x540
ret
push ebp
mov ebp, dword [esp + 8]
shr ebp, 2
cmp ebp, 0xc8
jle 0x7020e081
mov ebp, 0xc8
lea eax, [ebp*8]
push edi
push eax
call fcn.702e20da
mov edi, eax
add esp, 4
test edi, edi
jne 0x7020e0af
pop edi
pop ebp
mov ecx, dword [esp + 0x53c]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x540
ret
push ebx
push esi
xor esi, esi
xor ebx, ebx
test ebp, ebp
jle 0x7020e119
lea esp, [esp]
mov edx, dword [esp + ebx*4 + 0x24]
mov eax, dword [esp + 0x10]
push 0x104
lea ecx, [esp + 0x348]
push ecx
push edx
push eax
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
jbe 0x7020e110
mov edx, dword [esp + ebx*4 + 0x24]
mov eax, dword [esp + 0x10]
push 0xc
lea ecx, [esp + 0x1c]
push ecx
push edx
push eax
call sub.PSAPI.DLL_GetModuleInformation
test eax, eax
je 0x7020e110
mov ecx, dword [esp + 0x18]
mov dword [edi + esi*8], ecx
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
add eax, edx
mov dword [edi + esi*8 + 4], eax
inc esi
inc ebx
cmp ebx, ebp
jl 0x7020e0c0
test esi, esi
jne 0x7020e126
push edi
call fcn.702e1dee
add esp, 4
xor eax, eax
jmp 0x7020e170
push 0x7020dff0
push 8
push esi
push edi
call fcn.702e3060
add esp, 0x10
push 0x70354bd0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x70354bc4]
test eax, eax
je 0x7020e154
push eax
call fcn.702e1dee
add esp, 4
push 0x70354bd0
mov dword [0x70354bc4], edi
mov dword [0x70354bc8], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov ecx, dword [esp + 0x54c]
pop esi
pop ebx
pop edi
pop ebp
xor ecx, esp
call fcn.702e1c2f
add esp, 0x540
ret
Function at 0x7020f6f0
Capabilities:
Check if file exists
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 0
je 0x7020f728
mov eax, 1
pop esi
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x414
ret
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xe]
push ecx
mov word [esp + 0x10], ax
call fcn.702e95e0
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x222]
push eax
mov word [esp + 0x224], dx
call fcn.702e95e0
add esp, 0x18
push 1
push 0x1c
lea ecx, [esp + 0x214]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov eax, dword [esi + 0xc4]
cmp eax, 1
jne 0x7020f798
push str.GoogleChromeUser_Data
lea edx, [esp + 0x210]
push edx
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
jmp 0x7020f7df
cmp eax, 2
jne 0x7020f7df
push str.Microsoft_
lea ecx, [esp + 0x210]
push ecx
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
cmp dword [esi + 0x6c], 8
jb 0x7020f7c0
mov eax, dword [esi + 0x58]
jmp 0x7020f7c3
lea eax, [esi + 0x58]
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push eax
lea eax, [esp + 0xc]
push eax
call edi
push str.User_Data
lea ecx, [esp + 0xc]
push ecx
call edi
pop edi
lea edx, [esp + 4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x7020f811
lea eax, [esp + 4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x7020f7f5
sub eax, edx
sar eax, 1
push eax
add esi, 0x38
lea eax, [esp + 8]
call fcn.7020f4d0
mov ecx, dword [esp + 0x414]
pop esi
xor ecx, esp
xor eax, eax
call fcn.702e1c2f
add esp, 0x414
ret
Function at 0x7020fbd0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x210
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.702e95e0
add esp, 0xc
mov ecx, esi
call fcn.7020f6f0
test eax, eax
je 0x7020fcca
test edi, edi
je 0x7020fc5e
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x7020fc20
sub eax, edx
sar eax, 1
je 0x7020fc5e
cmp dword [esi + 0x50], 8
jb 0x7020fc3c
mov eax, dword [esi + 0x3c]
jmp 0x7020fc3f
lea eax, [esi + 0x3c]
push edi
push eax
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.Extensions
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x7020fc7d
cmp dword [esi + 0x50], 8
jb 0x7020fc69
mov eax, dword [esi + 0x3c]
jmp 0x7020fc6c
lea eax, [esi + 0x3c]
push str.DefaultExtensions
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x7020fcca
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x7020fc93
sub eax, edx
sar eax, 1
push eax
add esi, 0x1c
lea eax, [esp + 0xc]
call fcn.7020f4d0
mov eax, 1
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x210
ret
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
xor eax, eax
call fcn.702e1c2f
add esp, 0x210
ret

Function at 0x7020fcf0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x7030eff9
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, 7
xor edi, edi
xor ecx, ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], edi
mov word [esi + 4], cx
mov dword [esp + 0x14], edi
xor edx, edx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], edi
mov word [esi + 0x20], dx
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], edi
mov word [esi + 0x3c], cx
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], edi
mov word [esi + 0x58], dx
lea eax, [esi + 0x70]
push eax
mov byte [esp + 0x18], 3
call fcn.70210240
xor eax, eax
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], eax
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
xor ecx, ecx
mov word [esi + 0xb6], cx
mov dword [esi + 0xb8], edi
mov dword [esi + 0xc0], edi
mov dword [esi + 0xc4], 1
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x70210030
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [esi + 0x18], 8
push ebp
push edi
mov dword [esp + 0x18], ebx
jb 0x70210047
mov eax, dword [esi + 4]
jmp 0x7021004a
lea eax, [esi + 4]
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x70210101
lea eax, [esp + 0x10]
push eax
push ebp
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp dword [esp + 0x10], ebx
ja 0x7021010c
cmp edi, ebx
je 0x7021010c
lea ebx, [edi + 2]
push 0x70358018
push ebx
call fcn.702e36d5
add esp, 8
mov dword [esi + 0xb8], eax
test eax, eax
je 0x702100fa
push ebx
push 0
push eax
call fcn.702e95e0
mov edx, dword [esi + 0xb8]
add esp, 0xc
push 0
lea ecx, [esp + 0x18]
push ecx
push edi
push edx
push ebp
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x702100fa
cmp dword [esp + 0x14], edi
jne 0x702100fa
mov eax, dword [esi + 0xb8]
lea ebx, [esi + 0x70]
call fcn.70210330
cmp dword [esi + 0xa0], 0
jne 0x702100fa
mov dword [esp + 0x18], 1
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
pop edi
pop ebp
pop ebx
add esp, 0x10
ret
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret

Function at 0x70210240
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x7030dda3
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
xor edi, edi
mov word [esi + 0xe], ax
mov dword [esp + 0x14], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x400
mov byte [esp + 0x14], 1
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
cmp dword [esi + 0x10], edi
jne 0x702102d3
push 0x14
call fcn.702e1f8d
add esp, 4
cmp eax, edi
je 0x702102cb
mov dword [eax], edi
mov dword [eax + 4], 0x10000
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
jmp 0x702102cd
xor eax, eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x70210600
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x703107a0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebp
push esi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [ebx + 0x18]
lea ebp, [ebx + 0x18]
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0x100
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0xc], ebx
push ebx
lea eax, [esp + 0x14]
push eax
lea esi, [esp + 0x20]
mov byte [esp + 0x48], 1
call fcn.70210780
mov ecx, dword [eax]
mov dword [ebx + 0x30], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x34], edx
test ecx, ecx
jne 0x7021069f
add dword [ebp + 0xc], 0xfffffff0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebx], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 4], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 8], ecx
mov edx, dword [eax + 0xc]
xor ecx, ecx
mov dword [ebx + 0xc], edx
mov word [eax + 0xe], cx
mov edx, dword [ebp + 8]
mov esi, ebp
mov dword [ebp + 0xc], edx
call fcn.70210720
mov eax, dword [esp + 0x20]
push eax
call fcn.702e1dee
mov ecx, dword [esp + 0x20]
add esp, 4
push ecx
call fcn.702e1c24
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x38
ret

Function at 0x702122d0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x218
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x214], eax
mov eax, dword [esp + 0x21c]
mov ecx, dword [esp + 0x220]
push edi
lea edx, [esp + 8]
push edx
push eax
mov dword [esp + 0x14], ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
jne 0x7021231f
pop edi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x218
ret
mov ecx, dword [esp + 8]
cmp ecx, 2
mov dword [esp + 4], 0
jl 0x7021239e
push esi
mov esi, 1
cmp ecx, esi
jle 0x7021239d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SearchPathW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
jmp 0x70212350
mov eax, dword [edi + esi*4]
cmp word [eax], 0x2f
je 0x7021238c
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x104
push str..dll
push eax
push 0
call ebx
test eax, eax
je 0x70212388
mov edx, dword [esp + 0x18]
push 0x104
push edx
lea eax, [esp + 0x24]
push eax
call ebp
test eax, eax
jne 0x70212393
mov ecx, dword [esp + 0x14]
inc esi
cmp esi, ecx
jl 0x70212350
jmp 0x7021239b
mov dword [esp + 0x10], 1
pop ebp
pop ebx
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x218]
mov eax, dword [esp + 4]
pop edi
xor ecx, esp
call fcn.702e1c2f
add esp, 0x218
ret
Function at 0x702123c0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x21c
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x224]
lea edx, [esp + 4]
push edx
push eax
mov dword [esp + 0x14], ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 8], eax
test eax, eax
jne 0x7021240f
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x21c
ret
push edi
mov edi, 1
cmp dword [esp + 8], edi
mov dword [esp + 4], 0
jle 0x70212494
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_StrChrW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SearchPathW]
push esi
mov eax, dword [esp + 0x18]
mov esi, dword [eax + edi*4]
cmp word [esi], 0x2f
je 0x70212480
push 0x2c
push esi
call ebx
test eax, eax
je 0x7021244d
xor ecx, ecx
mov word [eax], cx
push 0
lea edx, [esp + 0x24]
push edx
push 0x104
push str..dll
push esi
push 0
call ebp
test eax, eax
je 0x70212480
mov eax, dword [esp + 0x1c]
push 0x104
push eax
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x70212489
inc edi
cmp edi, dword [esp + 0x14]
jl 0x70212432
jmp 0x70212491
mov dword [esp + 0x10], 1
pop esi
pop ebp
pop ebx
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x21c]
mov eax, dword [esp + 4]
pop edi
xor ecx, esp
call fcn.702e1c2f
add esp, 0x21c
ret

Function at 0x702124c0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x218
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x214], eax
mov eax, dword [esp + 0x21c]
mov ecx, dword [esp + 0x220]
push edi
lea edx, [esp + 8]
push edx
push eax
mov dword [esp + 0x14], ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
jne 0x7021250f
pop edi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x218
ret
push esi
mov esi, 1
cmp dword [esp + 0xc], esi
mov dword [esp + 8], 0
jle 0x7021257c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SearchPathW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov eax, dword [edi + esi*4]
cmp word [eax], 0x2f
je 0x70212569
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x104
push str..vbs
push eax
push 0
call ebx
test eax, eax
je 0x70212569
mov edx, dword [esp + 0x18]
push 0x104
push edx
lea eax, [esp + 0x24]
push eax
call ebp
test eax, eax
jne 0x70212572
inc esi
cmp esi, dword [esp + 0x14]
jl 0x70212531
jmp 0x7021257a
mov dword [esp + 0x10], 1
pop ebp
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x21c]
mov eax, dword [esp + 8]
pop esi
pop edi
xor ecx, esp
call fcn.702e1c2f
add esp, 0x218
ret
Function at 0x702125a0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x210
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x214]
push ebx
mov ebx, dword [esp + 0x21c]
push esi
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x7021263a
cmp dword [esp + 8], 1
jle 0x7021263a
mov eax, dword [esi + 4]
push edi
xor edi, edi
push edi
lea edx, [esp + 0x14]
push edx
push 0x104
push str..hta
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x70212619
push 0x104
push ebx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x70212619
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x210
ret
mov ecx, dword [esp + 0x214]
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.702e1c2f
add esp, 0x210
ret