joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41395a
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, eax
mov esi, 1
xor eax, eax
xor ecx, ecx
mov edx, esi
mov ebx, ecx
shl edx, 4
shl ebx, 2
add edx, edi
add edx, ebx
xor ebx, ebx
add edx, 0x14
movzx ebp, byte [edx + 1]
mov bl, byte [edx]
lea ebp, [ebp*4 + 0x440a9e]
lea ebx, [ebx*4 + 0x44069e]
mov bl, byte [ebx + eax]
xor bl, byte [ebp + eax]
movzx ebp, byte [edx + 2]
movzx edx, byte [edx + 3]
lea ebp, [ebp*4 + 0x440e9e]
lea edx, [edx*4 + 0x44129e]
xor bl, byte [ebp + eax]
xor bl, byte [edx + eax]
lea edx, [esp + ecx*4]
mov byte [edx + eax], bl
inc ecx
cmp ecx, 4
jl 0x41396c
inc eax
cmp eax, 4
jl 0x41396a
mov ecx, esi
push 0x10
shl ecx, 4
lea eax, [esp + 4]
add ecx, edi
push eax
add ecx, 0x14
push ecx
call fcn.00438f0a
add esp, 0xc
inc esi
cmp esi, 0xa
jl 0x413968
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x415e42
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [eax]
cmp edx, 0x11
jle 0x415e62
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x44], ecx
mov ecx, dword [eax + edx*4]
xor dword [eax + edx*4 - 0x38], ecx
xor ecx, ecx
mov dword [eax + edx*4], ecx
dec edx
cmp edx, 0x11
jg 0x415e49
cmp dword [eax], 0x11
jbe 0x415e7d
mov dword [eax], 0x11
jmp 0x415e71
dec dword [eax]
mov edx, dword [eax]
test edx, edx
je 0x415e7d
cmp dword [eax + edx*4], 0
je 0x415e6f
ret

Function at 0x4166b6
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, dword [esi]
cmp eax, dword [ebx]
jae 0x4166fd
mov eax, 1
jmp 0x4166d6
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [esi]
jbe 0x4166cc
mov ecx, dword [ebx]
mov edx, eax
sub ecx, dword [esi]
shl ecx, 2
shl edx, 2
push ecx
mov ecx, edx
add ecx, ebx
add edx, edi
push ecx
push edx
call fcn.00438f0a
add esp, 0xc
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x416762
mov eax, dword [esi]
cmp eax, dword [ebx]
jbe 0x41673b
mov eax, 1
jmp 0x416714
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [ebx]
jbe 0x41670a
mov ecx, dword [esi]
mov edx, eax
sub ecx, dword [ebx]
shl ecx, 2
shl edx, 2
push ecx
mov ecx, edx
add ecx, esi
add edx, edi
push ecx
push edx
call fcn.00438f0a
add esp, 0xc
mov eax, dword [esi]
mov dword [edi], eax
jmp 0x416762
mov eax, dword [ebx]
test eax, eax
jbe 0x41674e
mov edx, dword [esi + eax*4]
xor edx, dword [ebx + eax*4]
jne 0x41674e
dec eax
test eax, eax
ja 0x416741
mov dword [edi], eax
test eax, eax
jbe 0x416762
mov ecx, dword [esi + eax*4]
xor ecx, dword [ebx + eax*4]
mov dword [edi + eax*4], ecx
dec eax
test eax, eax
ja 0x416754
pop edi
pop esi
pop ebx
ret
Function at 0x41f1ca
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xffffff70
xor eax, eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
xor edx, edx
mov dword [esp + 8], edx
mov esi, dword [esp + 8]
jmp 0x41f247
xor eax, eax
mov edx, dword [esp]
add edx, esi
add edx, eax
mov cl, byte [edx + 1]
mov byte [esp + eax + 0x19], cl
mov bl, byte [edx]
sub bl, cl
mov byte [esp + eax + 0x18], bl
mov dl, byte [edx + 2]
sub dl, cl
mov byte [esp + eax + 0x1a], dl
add eax, 3
cmp eax, 0x78
jl 0x41f1f5
mov ebx, 3
mov cl, byte [esp + ebx + 0x18]
sub cl, byte [esp + ebx + 0x15]
movsx ecx, cl
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esp + 8]
add dword [esp + edx*4 + 0xc], eax
inc ebx
cmp ebx, 0x78
jl 0x41f221
add esi, 0x780
mov eax, dword [esp + 4]
add eax, 0xffffff88
cmp esi, eax
jl 0x41f1f3
inc dword [esp + 8]
cmp dword [esp + 8], 2
jle 0x41f1ed
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
cmp edx, eax
jb 0x41f273
cmp eax, dword [esp + 0x14]
ja 0x41f273
xor eax, eax
jmp 0x41f285
cmp edx, dword [esp + 0x14]
ja 0x41f280
mov eax, 1
jmp 0x41f285
mov eax, 2
add esp, 0x90
pop esi
pop ebx
ret
Function at 0x3b21000
Capabilities:
Get common file path

Disassembly:
cmp dword [0x3b87a30], 0
jne 0x3b2108f
cmp dword [0x3b87820], 0
mov eax, 1
mov dword [0x3b87a30], eax
jne 0x3b21035
push 0x104
push 0x3b87828
mov dword [0x3b87820], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
jmp 0x3b21040
movzx ecx, word [eax + 0x3b87828]
mov word [eax + 0x3b87a38], cx
add eax, 2
test cx, cx
jne 0x3b21040
mov eax, 0x3b87a38
add eax, 0xfffffffe
mov edi, edi
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x3b21060
mov ecx, dword [str.Ocular]
mov edx, dword [0x3b6f498]
mov dword [eax], ecx
mov ecx, dword [0x3b6f49c]
mov dword [eax + 4], edx
mov edx, dword [0x3b6f4a0]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, 0x3b87a38
ret
Function at 0x3b210a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x3b77140]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x41c], esi
test edi, edi
je 0x3b212a3
cmp word [edi], 0
je 0x3b212a3
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x3b210d7
sub eax, edx
sar eax, 1
mov ebx, eax
xor eax, eax
cmp ebx, 0x104
ja 0x3b212a5
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.03b37ba0
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x416]
push eax
mov word [ebp - 0x418], dx
call fcn.03b37ba0
add esp, 0xc
push ebx
lea ecx, [ebp - 0x210]
push edi
push ecx
call fcn.03b2b6db
add esp, 0xc
push 0x208
lea edx, [ebp - 0x418]
push 0
push edx
call fcn.03b37ba0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x3b21202
lea ecx, [ecx]
lea ecx, [ebp - 0x210]
push 0x5c
push ecx
call fcn.03b2b6af
mov esi, eax
add esp, 8
test esi, esi
je 0x3b212a3
push 0x208
lea edx, [ebp - 0x210]
push 0
push edx
call fcn.03b37ba0
add esp, 0xc
push 0x208
lea eax, [ebp - 0x418]
push 0
push eax
call fcn.03b37ba0
lea ecx, [ebp - 0x210]
sub esi, ecx
add esp, 0xc
shr esi, 1
push esi
mov edx, ecx
push edi
push edx
call fcn.03b2b6db
add esp, 0xc
mov eax, ebx
sub eax, esi
push eax
lea ecx, [edi + esi*2]
push ecx
lea edx, [ebp - 0x418]
push edx
call fcn.03b2b6db
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x3b21170
mov esi, dword [ebp - 0x41c]
push esi
lea ecx, [ebp - 0x210]
xor edi, edi
call fcn.03b23350
add esp, 4
test eax, eax
je 0x3b21287
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x3b21220
sub eax, edx
sar eax, 1
mov edi, eax
je 0x3b21287
cmp edi, 0x104
jae 0x3b21287
lea eax, [ebp - 0x418]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x3b21244
sub eax, edx
sar eax, 1
je 0x3b21287
mov ecx, 0x104
sub ecx, edi
push ecx
lea edx, [ebp - 0x418]
push edx
push esi
call fcn.03b2b725
lea eax, [ebp - 0x418]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x3b21276
sub eax, edx
sar eax, 1
add edi, eax
xor eax, eax
mov word [esi + 0x206], ax
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.03b2b6a0
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.03b2b6a0
mov esp, ebp
pop ebp
ret
Function at 0x3b22450
Capabilities:
Access peb ldr_data
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x3b62198
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x3b77140]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [0x3b9231c]
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], ecx
cmp eax, ecx
je 0x3b224f9
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push edi
call eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x3b224f9
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x1c], edx
mov edx, dword [ebp + 8]
push edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x1c]
push ebx
push esi
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
mov dword [esi + 0xc], edx
jmp 0x3b2251d
mov edi, dword [esi + 0x18]
test edi, edi
je 0x3b2251d
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp + 8]
push eax
push ebx
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov esi, dword [esi + 0x14]
mov dword [esp + 0x10], esi
test ebx, ebx
je 0x3b22596
cmp dword [0x3b867c8], 0
je 0x3b2254d
mov ecx, dword [0x3b842c4]
push ebx
push ecx
push str.__s__MoveFileA_FileName__s__n
push 4
mov edi, str.Test
call fcn.03b218e0
add esp, 0x10
test esi, esi
je 0x3b22596
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x3b22596
push ebx
lea ecx, [esp + 0x10]
call fcn.03b273b0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x3b22585
mov esi, eax
call fcn.03b21d60
test eax, eax
je 0x3b225ac
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.03b27960
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esp + 0xc]
push edx
call fcn.03b23aa0
test eax, eax
jne 0x3b225eb
cmp dword [0x3b867c8], eax
je 0x3b225e2
mov eax, dword [esp + 0xc]
mov ecx, dword [0x3b842c4]
push eax
push ecx
push str.__s__MoveFileA_Need_Record_FileName__s__n
push 4
mov edi, str.FileFollow
call fcn.03b218e0
add esp, 0x10
mov edi, dword [esp + 0xc]
call fcn.03b22bb0
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.03b27960
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x3b22620
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x24]
mov ebx, dword [edi + 0x1c]
mov esi, eax
mov eax, dword [edi + 0x20]
mov dword [esp + 0x1c], eax
mov eax, dword [0x3b9231c]
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], ecx
cmp eax, ecx
je 0x3b226ac
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
call eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x3b226ac
mov edx, dword [esp + 0x14]
mov ecx, dword [edi + 0xc]
mov dword [edi + 0x1c], edx
mov edx, dword [ebp + 8]
push edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x1c]
push esi
push edi
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ecx
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ecx
mov dword [edi + 0xc], edx
jmp 0x3b226d0
mov ebx, dword [edi + 0x18]
test ebx, ebx
je 0x3b226d0
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp + 8]
push ecx
push esi
call ebx
mov dword [edi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x10], eax
mov ebx, dword [edi + 0x14]
test esi, esi
je 0x3b22748
cmp dword [0x3b867c8], 0
je 0x3b226fc
mov edx, dword [0x3b842c4]
push esi
push edx
push str.__s__MoveFileW_FileName__s__n
push 4
mov edi, str.Test
call fcn.03b218e0
add esp, 0x10
test ebx, ebx
je 0x3b22748
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x3b22748
call fcn.03b21d60
test eax, eax
jne 0x3b22748
push esi
call fcn.03b23aa0
test eax, eax
jne 0x3b22748
cmp dword [0x3b867c8], eax
je 0x3b22741
mov eax, dword [0x3b842c4]
push esi
push eax
push str.__s__MoveFileW_Need_Record_FileName__s__n
push 4
mov edi, str.FileFollow
call fcn.03b218e0
add esp, 0x10
mov edi, esi
call fcn.03b22bb0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x3b22760
Capabilities:
Access peb ldr_data
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x3b62198
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x3b77140]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [0x3b9231c]
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], ecx
cmp eax, ecx
je 0x3b2280d
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push edi
call eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x3b2280d
mov ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x1c], edx
mov edx, dword [ebp + 0xc]
push edx
mov dword [esi + 0x24], ecx
mov ecx, dword [ebp + 8]
push ecx
push ebx
push esi
mov dword [esi + 0x20], eax
call eax
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], eax
mov dword [esi + 0xc], ecx
jmp 0x3b22835
mov edi, dword [esi + 0x18]
test edi, edi
je 0x3b22835
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edx
push eax
push ebx
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov esi, dword [esi + 0x14]
mov dword [esp + 0x10], esi
test ebx, ebx
je 0x3b228ae
cmp dword [0x3b867c8], 0
je 0x3b22865
mov ecx, dword [0x3b842c4]
push ebx
push ecx
push str.__s__MoveFileExA_FileName__s__n
push 4
mov edi, str.Test
call fcn.03b218e0
add esp, 0x10
test esi, esi
je 0x3b228ae
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x3b228ae
push ebx
lea ecx, [esp + 0x10]
call fcn.03b273b0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x3b2289d
mov esi, eax
call fcn.03b21d60
test eax, eax
je 0x3b228c4
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.03b27960
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [esp + 0xc]
push edx
call fcn.03b23aa0
test eax, eax
jne 0x3b22903
cmp dword [0x3b867c8], eax
je 0x3b228fa
mov eax, dword [esp + 0xc]
mov ecx, dword [0x3b842c4]
push eax
push ecx
push str.__s__MoveFileExA_Need_Record_FileName__s__n
push 4
mov edi, str.FileFollow
call fcn.03b218e0
add esp, 0x10
mov edi, dword [esp + 0xc]
call fcn.03b22bb0
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.03b27960
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x3b22930
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x24]
mov ebx, dword [edi + 0x1c]
mov esi, eax
mov eax, dword [edi + 0x20]
mov dword [esp + 0x1c], eax
mov eax, dword [0x3b9231c]
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], ecx
cmp eax, ecx
je 0x3b229c0
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
call eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x3b229c0
mov ecx, dword [edi + 0xc]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x18]
mov dword [edi + 0x1c], edx
mov edx, dword [ebp + 0xc]
push edx
mov dword [edi + 0x24], ecx
mov ecx, dword [ebp + 8]
push ecx
push esi
push edi
mov dword [edi + 0x20], eax
call eax
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], edx
mov dword [edi + 0x24], eax
mov dword [edi + 0xc], ecx
jmp 0x3b229e8
mov ebx, dword [edi + 0x18]
test ebx, ebx
je 0x3b229e8
mov edx, dword [edi + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
push esi
call ebx
mov dword [edi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x10], eax
mov ebx, dword [edi + 0x14]
test esi, esi
je 0x3b22a60
cmp dword [0x3b867c8], 0
je 0x3b22a14
mov edx, dword [0x3b842c4]
push esi
push edx
push str.__s__MoveFileExW_FileName__s__n
push 4
mov edi, str.Test
call fcn.03b218e0
add esp, 0x10
test ebx, ebx
je 0x3b22a60
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x3b22a60
call fcn.03b21d60
test eax, eax
jne 0x3b22a60
push esi
call fcn.03b23aa0
test eax, eax
jne 0x3b22a60
cmp dword [0x3b867c8], eax
je 0x3b22a59
mov eax, dword [0x3b842c4]
push esi
push eax
push str.__s__MoveFileExW_Need_Record_FileName__s__n
push 4
mov edi, str.FileFollow
call fcn.03b218e0
add esp, 0x10
mov edi, esi
call fcn.03b22bb0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x3b22f80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 1
xor edi, edi
push 0x3b92444
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
call fcn.03b2a6e0
xor esi, esi
mov ebx, 0x3b87f40
cmp dword [ebx - 8], 0
je 0x3b22fbb
mov eax, dword [ebp + 8]
push ebx
push eax
call fcn.03b2bbae
add esp, 8
test eax, eax
je 0x3b22fd5
add edi, 0x418
inc esi
add ebx, 0x418
cmp edi, 0xa3c0
jb 0x3b22fa4
mov edi, dword [ebp - 4]
jmp 0x3b23000
mov edx, dword [ebp + 0xc]
mov edi, esi
imul edi, edi, 0x418
push 0x103
lea ecx, [edi + 0x3b88148]
push ecx
push edx
call fcn.03b2b6db
add esp, 0xc
inc dword [edi + 0x3b87f3c]
mov edi, 1
lea ecx, [ebp - 0x10]
call fcn.03b2a710
test edi, edi
je 0x3b2304d
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x3b2304d
push 1
push 0x3b92444
lea ecx, [ebp - 0x10]
call fcn.03b2a6e0
imul esi, esi, 0x418
mov dword [esi + 0x3b87f38], 0
lea ecx, [ebp - 0x10]
xor esi, esi
call fcn.03b2a710
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x3b24370
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x3b77140]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x3b83eac], eax
mov eax, dword [0x3b92548]
push 0x3ff
mov dword [0x3b83eb0], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x3b842c8
call fcn.03b2b6db
add esp, 0xc
push 0x207
mov ecx, 0x3b924b0
call fcn.03b3fb60
push eax
push 0x3b83eb4
call fcn.03b2b6db
add esp, 0xc
push 0x3b7052c
push 0x3b83eb4
call fcn.03b2bf20
add esp, 8
test eax, eax
je 0x3b2442f
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x20e]
push edx
mov word [ebp - 0x210], cx
call fcn.03b37ba0
add esp, 0xc
lea edx, [ebp - 0x210]
mov ecx, 0x3b83eb4
call fcn.03b210a0
test eax, eax
jbe 0x3b2442f
push 0x207
lea eax, [ebp - 0x210]
push eax
push 0x3b83eb4
call fcn.03b2b6db
add esp, 0xc
push 0x3b83eb4
call fcn.03b3db70
mov ecx, dword [ebp - 4]
mov dword [0x3b842c4], eax
xor ecx, ebp
add esp, 4
mov eax, 1
call fcn.03b2b6a0
mov esp, ebp
pop ebp
ret
Function at 0x3b25110
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3b61efb
mov eax, dword fs:[0]
push eax
sub esp, 0xe1c
mov eax, dword [0x3b77140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [0x3b9257c], ebx
jne 0x3b25372
push 0x3ff
lea eax, [ebp - 0x617]
push ebx
push eax
mov dword [0x3b9257c], 1
mov byte [ebp - 0x618], bl
call fcn.03b37ba0
push 0x7fe
lea edx, [ebp - 0xe16]
xor ecx, ecx
push ebx
push edx
mov dword [ebp - 0xe1c], ebx
mov dword [ebp - 0xe20], ebx
mov word [ebp - 0xe18], cx
call fcn.03b37ba0
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x218], ax
call fcn.03b37ba0
add esp, 0x24
push str.OAgent.ini
call section..text
push eax
lea edx, [ebp - 0x218]
push 0x3b70104
push edx
call fcn.03b2bf81
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
push 0x400
lea ecx, [ebp - 0xe18]
push ecx
push 0x3b70400
push 0x3b701a8
push str.AgentConfig
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, ebx
jbe 0x3b2522a
cmp word [ebp - 0x61a], bx
jne 0x3b2522a
push 0x400
lea edx, [ebp - 0x618]
push edx
lea eax, [ebp - 0xe18]
push eax
call fcn.03b56ba0
add esp, 0xc
mov dword [ebp - 0xe1c], eax
jmp 0x3b25230
mov eax, dword [ebp - 0xe1c]
cmp eax, ebx
jne 0x3b25342
lea ecx, [ebp - 0xe28]
call fcn.03b2a740
push 0x20019
push str.SOFTWAREClassesCLSIDAFFAEF68_CDC5_4aad_9D3F_997C0D55927BProgID
push 0x80000002
lea ecx, [ebp - 0xe28]
mov dword [ebp - 4], ebx
call fcn.03b2a830
test eax, eax
je 0x3b252b1
lea ecx, [ebp - 0xe1c]
push ecx
lea edx, [ebp - 0xe20]
push edx
push 0x3b7023c
lea ecx, [ebp - 0xe28]
call fcn.03b2a9e0
test eax, eax
je 0x3b252b1
mov eax, dword [ebp - 0xe20]
cmp eax, ebx
je 0x3b252b1
mov esi, eax
mov ecx, 0xff
lea edi, [ebp - 0x618]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push eax
movsb byte es:[edi], byte [esi]
call fcn.03b2b765
add esp, 4
mov dword [ebp - 0xe20], ebx
lea ecx, [ebp - 0xe28]
call fcn.03b2a880
lea ecx, [ebp - 0xe28]
mov dword [ebp - 4], 0xffffffff
call fcn.03b2a880
mov eax, dword [ebp - 0xe1c]
cmp eax, ebx
jne 0x3b25342
push 0x800
lea eax, [ebp - 0xe18]
push ebx
push eax
call fcn.03b37ba0
add esp, 0xc
push 0x400
lea ecx, [ebp - 0xe18]
push ecx
push 0x3b70400
push 0x3b7023c
push str.ED30_8AC4_11D5_8930_A730
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
test eax, eax
jbe 0x3b25338
cmp word [ebp - 0x61a], bx
jne 0x3b25338
push 0x400
lea edx, [ebp - 0x618]
push edx
lea eax, [ebp - 0xe18]
push eax
call fcn.03b56ba0
add esp, 0xc
jmp 0x3b2533e
mov eax, dword [ebp - 0xe1c]
cmp eax, ebx
je 0x3b25372
cmp eax, 4
jbe 0x3b25372
cmp dword [ebp - 0x618], 1
je 0x3b25372
movzx ecx, word [ebp - 0x5fc]
lea ecx, [ecx + ecx + 0x22]
cmp ecx, ebx
je 0x3b25372
add eax, 0xfffffffc
cmp ecx, eax
ja 0x3b25372
mov ecx, dword [ebp - 0x610]
mov dword [0x3b922f8], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.03b2b6a0
mov esp, ebp
pop ebp
ret