joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40be10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov dword [ebp - 0xc], ecx
push esi
mov edx, 0x446288
lea ecx, [ebp - 4]
xor ebx, ebx
call fcn.0040ad60
mov eax, dword [ebp - 4]
cmp dword [eax - 0xc], ebx
je 0x40bece
xor esi, esi
push edi
lea esp, [esp]
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 8]
push edx
push 0
xor ecx, ecx
push 2
test esi, esi
push 0
setne cl
push 0
push 0
push eax
mov dword [ebp - 8], 0
add ecx, 0x80000001
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40bec0
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
test edx, edx
jne 0x40be81
lea eax, [edx + 0xd]
jmp 0x40beae
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40be86
sub eax, ebx
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push 0x4410a0
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test edi, edi
je 0x40bec0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
inc esi
cmp esi, 2
jl 0x40be40
pop edi
lea esi, [eax - 0x10]
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40bee8
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + reloc.winmm.dll_mmioOpenA]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40fbb0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438fd8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x444690]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edx, 0x47a990
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
call fcn.0040ad60
mov edx, 0x47a96c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0040ad60
mov byte [ebp - 4], 2
mov eax, dword [0x444008]
mov ecx, 0x444008
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x1c], esi
mov ecx, 0x6a
mov byte [ebp - 4], 3
call fcn.00404890
test eax, eax
je 0x40fc37
push 0x6a
push eax
lea ecx, [ebp - 0x1c]
call fcn.004043f0
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 0
je 0x40fcf5
mov ecx, dword [ebp - 0x14]
cmp dword [ecx - 0xc], 0
je 0x40fcf5
cmp dword [esi - 0xc], 0
je 0x40fcf5
xor ebx, ebx
lea ecx, [ecx]
xor ecx, ecx
test ebx, ebx
setne cl
sub esp, 8
mov dword [ebp - 0x28], 0
push 2
sub esp, 8
mov dword [ebp - 0x24], 0
push eax
add ecx, 0x80000001
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x20], 0
call fcn.0040fb30
test eax, eax
jne 0x40fccb
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40fca0
mov edi, dword [ebp - 0x28]
sub eax, edx
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push dword [ebp - 0x14]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40fcce
mov edi, dword [ebp - 0x28]
test edi, edi
je 0x40fce0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x28], 0
inc ebx
mov dword [ebp - 0x24], 0
cmp ebx, 2
jge 0x40fcf5
mov eax, dword [ebp - 0x18]
jmp 0x40fc60
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov byte [ebp - 4], 2
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x40fd15
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.winmm.dll_mmioOpenA]
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40fd35
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.winmm.dll_mmioOpenA]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x40fd53
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.winmm.dll_mmioOpenA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x612f6d8b
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x571a402f
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x422f627c
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x4163f
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10001e84
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, ecx
xor esi, esi
push edi
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], eax
push ecx
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x10001f8b
push ebx
lea eax, [edi + edi]
push eax
push 1
call fcn.1004c0ee
pop ecx
pop ecx
mov ebx, eax
push ebx
push edi
push dword [ebp - 8]
push dword [ebp - 0x10]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push str.VarFileInfoTranslation
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x10001f7f
mov ecx, 0x400
lea eax, [edi + 1]
cmp edi, ecx
push 2
cmovb eax, ecx
xor ecx, ecx
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10045a36
mov ecx, dword [ebp - 0x14]
mov edi, eax
mov dword [esp], str.SpecialBuild
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04x_04x_s
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x10001f78
cmp dword [ebp - 4], esi
jbe 0x10001f78
push esi
call fcn.10045836
mov eax, dword [ebp - 4]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10045a36
pop ecx
pop ecx
push dword [ebp - 4]
mov esi, eax
push dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push edi
call fcn.10045836
pop ecx
push ebx
call fcn.1004e94a
pop ecx
mov eax, esi
pop ebx
jmp 0x10001f90
mov eax, 0x1007a938
pop edi
pop esi
leave
ret
Function at 0x100022c7
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1008b008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [0x1008dc44], eax
mov eax, dword [ebp + 0x14]
mov dword [0x1008dc48], eax
mov eax, dword [ebp + 0x10]
push 0x20a
mov dword [0x1008dc40], eax
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.10048ed0
add esp, 0xc
lea ecx, [ebp - 0x210]
call fcn.10002f9a
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x210]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x10002340
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x1007a97c
cmp eax, 0xb7
je 0x10002345
mov ecx, 0x1007a980
call fcn.10003013
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10045825
leave
ret

Function at 0x100023a7
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x1008b008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x43c], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x228
mov edi, eax
xor ebx, ebx
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.10048ed0
add esp, 0xc
mov dword [ebp - 0x438], 0x22c
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10002400
xor al, al
jmp 0x1000247a
lea eax, [ebp - 0x438]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x10002469
cmp dword [ebp - 0x430], edi
je 0x1000245b
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.10048ed0
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.1004ec1d
push dword [ebp - 0x43c]
lea eax, [ebp - 0x20c]
push eax
call fcn.1004e94f
add esp, 0x20
test eax, eax
je 0x1000246f
lea eax, [ebp - 0x438]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10002410
jmp 0x10002471
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10045825
leave
ret
Function at 0x10002489
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x1008b008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov esi, edx
push edi
mov dword [ebp - 0x444], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x228
mov dword [ebp - 0x448], eax
lea eax, [ebp - 0x434]
push 0
push eax
call fcn.10048ed0
add esp, 0xc
mov dword [ebp - 0x438], 0x22c
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x44c], edi
cmp edi, 0xffffffff
jne 0x100024f3
xor al, al
jmp 0x10002610
lea eax, [ebp - 0x438]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10002601
mov dword [ebp - 0x440], 0x18
mov eax, dword [ebp - 0x448]
cmp dword [ebp - 0x430], eax
je 0x100025eb
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10048ed0
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.1004ec1d
mov eax, dword [ebx + 4]
xor edx, edx
mov ecx, dword [ebx]
add esp, 0x18
sub eax, ecx
mov dword [ebp - 0x43c], edx
cdq
idiv dword [ebp - 0x440]
test eax, eax
je 0x100025eb
mov edi, dword [ebp - 0x444]
xor ebx, ebx
lea eax, [ebx + ecx]
cmp dword [eax + 0x10], 0
je 0x100025be
cmp dword [eax + 0x14], 8
jb 0x10002586
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.1004e94f
pop ecx
pop ecx
test eax, eax
jne 0x100025be
mov ecx, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x100025af
mov eax, dword [ebp - 0x430]
mov dword [ecx], eax
add dword [esi + 4], 4
jmp 0x100025be
lea eax, [ebp - 0x430]
push eax
push ecx
mov ecx, esi
call fcn.10002ad2
mov ecx, dword [edi]
push 0x18
pop eax
add ebx, eax
inc dword [ebp - 0x43c]
mov eax, dword [edi + 4]
sub eax, ecx
cdq
idiv dword [ebp - 0x440]
cmp dword [ebp - 0x43c], eax
jb 0x10002575
mov edi, dword [ebp - 0x44c]
mov ebx, dword [ebp - 0x444]
lea eax, [ebp - 0x438]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10002513
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
cmp eax, dword [esi + 4]
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10045825
leave
ret
Function at 0x1000261f
Capabilities:
Terminate process

Disassembly:
push 0x14
mov eax, 0x10066d98
call fcn.1006562c
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
lea edx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.10002489
mov edi, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x14], ebx
mov esi, edi
mov ebx, dword [ebp - 0x1c]
sub ebx, edi
add ebx, 3
shr ebx, 2
cmp edi, dword [ebp - 0x1c]
cmova ebx, eax
test ebx, ebx
je 0x100026b4
mov edi, eax
push dword [esi]
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x100026a0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x10002697
push 0x1388
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
add esi, 4
inc eax
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x10002665
mov dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x20]
test edi, edi
je 0x100026c9
mov ecx, dword [ebp - 0x18]
sub ecx, edi
and ecx, 0xfffffffc
push ecx
push edi
call fcn.10002d63
pop ecx
pop ecx
mov eax, dword [ebp - 0x10]
call fcn.10065606
ret
Function at 0x10003162
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x1008b008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0x24], ecx
push esi
push edi
push 0x40
push eax
mov ebx, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x74]
push eax
mov word [ebp - 8], 0x1000
call fcn.10048ed0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x78], 0x44
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 5
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
pop eax
inc edi
mov word [ebp - 0x48], ax
mov dword [ebp - 0x4c], edi
call esi
lea eax, [ebp - 0x10]
push eax
push 0x8b
call esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x100031ee
cmp dword [ebp - 0x10], ebx
je 0x10003220
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10003220
lea eax, [ebp - 0x14]
push eax
push edi
push 2
xor edi, edi
push edi
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x10003227
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x10003216
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0x14], ebx
je 0x10003220
push dword [ebp - 0x14]
call esi
xor eax, eax
jmp 0x100032ee
lea eax, [ebp - 0x18]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0x2000
push 1
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov eax, dword [ebp - 0x18]
push 0x20
pop esi
push eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea eax, [ebp - 0x20]
push eax
push 0x19
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x78]
push eax
push edi
push edi
push esi
push edi
push edi
push edi
push edi
push dword [ebp - 0x24]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x10003290
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], edi
je 0x100032a3
push dword [ebp - 0x10]
call esi
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x14], edi
je 0x100032b0
push dword [ebp - 0x14]
call esi
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x18], edi
je 0x100032c1
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x34], edi
je 0x100032ce
push dword [ebp - 0x34]
call esi
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x30], edi
je 0x100032db
push dword [ebp - 0x30]
call esi
mov dword [ebp - 0x30], edi
test ebx, ebx
je 0x100032eb
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10003220
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10045825
leave
ret
Function at 0x100032fd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x1008b008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [0x1008dc44], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [0x1008dc48], eax
xor edi, edi
mov eax, dword [ebp + 0x10]
push 0x410
mov dword [0x1008dc40], eax
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.10048ed0
add esp, 0xc
lea ecx, [ebp - 0x414]
call fcn.10002f9a
lea ecx, [ebp - 0x414]
call fcn.10003162
test eax, eax
jne 0x100033b0
push 0x44
lea eax, [ebp - 0x458]
push edi
push eax
call fcn.10048ed0
add esp, 0xc
mov dword [ebp - 0x458], 0x44
mov dword [ebp - 0x42c], 1
push 5
pop eax
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x458]
push eax
push edi
push edi
push 0x4000000
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10045825
leave
ret

Function at 0x100033bd
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, ecx
xorps xmm2, xmm2
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
movd xmm1, dword [eax + edi]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
add eax, 4
punpcklwd xmm1, xmm0
paddd xmm2, xmm1
cmp eax, 0xc18
jb 0x100033d2
movaps xmm0, xmm2
psrldq xmm0, 8
paddd xmm2, xmm0
movups xmm0, xmm2
push ebx
psrldq xmm0, 4
push 0x80
paddd xmm2, xmm0
movd ecx, xmm2
push 4
push ebx
push ebx
cmp ecx, 2
push 0x40000000
lea eax, [ecx - 2]
cmovbe eax, ecx
push edx
mov dword [edi + 0xc18], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x1000348e
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 2
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
mov dword [ebp - 0xc], eax
call ebx
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push 0
push eax
push 0xc1c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp + 8], 0xc1c
je 0x10003487
mov eax, dword [ebp - 4]
push 0
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100035d6
Capabilities:
Create process on windows

Disassembly:
push 0xb0
mov eax, 0x10066e81
call fcn.10065660
mov byte [ebp - 0x59], cl
mov eax, dword [ebp + 0x3c]
xor ebx, ebx
mov edi, dword [ebp + 0x38]
mov dword [ebp - 0x78], eax
mov dword [ebp - 4], 1
test dl, dl
je 0x10003624
cmp dword [ebp + 0x1c], 8
lea esi, [ebp + 8]
cmovae esi, dword [ebp + 8]
call fcn.10003fec
call fcn.1002be60
push ecx
push esi
mov ecx, eax
call fcn.1002c050
test al, al
je 0x100037a9
push 0x44
pop esi
push esi
lea eax, [ebp - 0xbc]
push ebx
push eax
call fcn.10048ed0
push 0x10
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.10048ed0
add esp, 0x18
mov dword [ebp - 0xbc], esi
cmp dword [ebp + 0x30], 0
mov dword [ebp - 0x90], 0x80
je 0x1000369a
cmp dword [ebp + 0x34], 8
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
cmp word [eax], 0x20
je 0x1000369a
lea eax, [ebp + 0x20]
mov edx, 0x1007aa6c
push eax
lea ecx, [ebp - 0x58]
call fcn.10003a9e
pop ecx
push eax
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0xa
call fcn.100039c9
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xb
call fcn.100029a3
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
mov edx, 0x1007aa70
push eax
lea ecx, [ebp - 0x58]
call fcn.10003a9e
mov esi, eax
mov byte [ebp - 4], 0xf
mov dword [esp], 0x1007aa70
call fcn.1004ec81
pop ecx
push eax
push 0x1007aa70
mov ecx, esi
call fcn.10003c2c
mov byte [ebp - 0x70], bl
lea ecx, [ebp - 0x40]
push dword [ebp - 0x70]
mov dword [ebp - 0x30], ebx
push eax
mov dword [ebp - 0x2c], ebx
call fcn.10002f2a
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x12
call fcn.100029a3
lea eax, [ebp + 0x20]
mov byte [ebp - 4], 0x11
push eax
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.10003b35
pop ecx
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xbc]
push ecx
push ebx
push ebx
push 0x4000020
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1000378d
test edi, edi
je 0x10003739
mov eax, dword [ebp - 0x64]
mov dword [edi], eax
cmp byte [ebp - 0x59], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x6c]
je 0x10003770
test eax, eax
je 0x10003770
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x78]
test eax, eax
je 0x10003766
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x6c]
call esi
mov eax, ebx
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x68], 0
je 0x10003781
push dword [ebp - 0x68]
call esi
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x68], ebx
test eax, eax
je 0x1000378b
push eax
call esi
mov dword [ebp - 0x6c], ebx
mov bl, 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x27
call fcn.100029a3
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x2b
call fcn.100029a3
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x2f
call fcn.100029a3
lea ecx, [ebp + 0x20]
mov dword [ebp - 4], 0x33
call fcn.100029a3
or dword [ebp - 4], 0xffffffff
mov al, bl
call fcn.1006561b
ret
Function at 0x10003e74
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x1008b008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1008dbbc], 0
jne 0x10003fde
push esi
push 0x410
xor esi, esi
mov byte [0x1008dbbc], 1
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.10048ed0
add esp, 0xc
mov dword [ebp - 0x82c], esi
lea eax, [ebp - 0x82c]
push eax
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x10003f03
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x82c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x10003efa
cmp dword [ebp - 0x82c], esi
je 0x10003f03
push dword [ebp - 0x82c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x10003f03
xor eax, eax
mov word [ebp - 0x414], ax
push edi
mov edi, 0x1007a958
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.1004e919
lea eax, [ebp - 0x414]
push str.2345Pic
push eax
call fcn.1004e919
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10003f45
xor eax, eax
mov word [ebp - 0x414], ax
push 0x412
lea eax, [ebp - 0x828]
push esi
push eax
call fcn.10048ed0
lea eax, [ebp - 0x414]
push eax
call fcn.1004ec81
add esp, 0x10
test eax, eax
je 0x10003fb6
push 0x207
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x828]
push eax
call fcn.1004eef7
lea eax, [ebp - 0x828]
push eax
call fcn.1004ec81
add esp, 0x10
test eax, eax
je 0x10003fb6
lea eax, [ebp - 0x828]
push edi
push eax
call fcn.1004e919
lea eax, [ebp - 0x828]
push str.2345Image.hzv
push eax
call fcn.1004e919
add esp, 0x10
call fcn.1002be60
mov esi, eax
lea eax, [ebp - 0x828]
push eax
call fcn.1004ec81
pop ecx
pop edi
test eax, eax
je 0x10003fdd
lea eax, [ebp - 0x828]
mov ecx, esi
push eax
call fcn.1002bf40
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10045825
leave
ret