joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x30154033
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x10e42351
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x402030
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, ax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00405313

Function at 0x402070
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402085
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4020c4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4020c0
lea ebx, [ebx]
cmp esi, edx
jae 0x4020c4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x4020b0
cmp esi, edx
jb 0x4020c9
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x4039d0
Capabilities:
Extract resource via kernel32 functions
Get common file path
Log keystrokes via application hook
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5384a4
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x598030]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x21c], ebx
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 8
push eax
mov dword [ebp - 0x224], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, ebx
call fcn.0041081e
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 8
push 0x13b
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x403b28
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x403b14
push str.WINGDNG3.TTF
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.005204aa
add esp, 0xc
lea ecx, [ebp - 0x23c]
call fcn.0041184c
push 0
push 0x1001
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x23c]
call fcn.00411d72
test eax, eax
je 0x403b02
push ebx
push dword [ebp - 0x220]
lea ecx, [ebp - 0x23c]
call fcn.004120d9
lea ecx, [ebp - 0x23c]
call fcn.00411b2c
push 0
push 0x10
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.GDI32.dll_AddFontResourceExW]
lea ecx, [ebp - 0x23c]
mov dword [ebp - 4], 0xffffffff
call fcn.004118c2
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, dword [ebp - 0x21c]
push 0x2b8
call fcn.004050eb
mov esi, eax
add esp, 4
mov dword [ebp - 0x21c], esi
mov dword [ebp - 4], 1
test esi, esi
je 0x403b76
mov ecx, esi
call fcn.004132ef
mov byte [ebp - 4], 2
lea ecx, [esi + 0x110]
mov dword [esi], vtable.CMainFrame.0
call fcn.00402b50
push ecx
lea ecx, [esi + 0x210]
mov byte [ebp - 4], 3
call fcn.004049f0
jmp 0x403b78
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test esi, esi
jne 0x403b87
xor eax, eax
jmp 0x403bfd
push 0
push 0
mov dword [ebx + 0x20], esi
mov ecx, esi
mov eax, dword [esi]
push 0xcf0000
push 0x80
call dword [eax + 0x164]
push 5
mov ecx, esi
call fcn.00408c06
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push edi
push 0x403ca0
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x5acf90], eax
test eax, eax
jne 0x403bf8
push 0xffffffffffffffff
push 0x10
push 0x81
call fcn.0040749e
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051fe74
mov esp, ebp
pop ebp
ret
Function at 0x403c20
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x598030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5acf90]
push esi
mov esi, ecx
test eax, eax
je 0x403c46
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x403c82
push str.WINGDNG3.TTF
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.005204aa
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, esi
call fcn.0041061c
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0051fe74
mov esp, ebp
pop ebp
ret

Function at 0x40536f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0040fa43
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4053a6
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.004053c7
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40ab02
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x40ab47
call fcn.0040fa43
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40ab47
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40ab63
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00416e75
mov ebx, eax
test edi, edi
je 0x40ab61
test esi, esi
je 0x40ab61
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4166eb
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.004088bb
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x416727
call fcn.0041690a
mov dword [esi + 0xc], 1
jmp 0x41672c
call fcn.0041690a
cmp dword [esi], 0
je 0x416775
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x41674f
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.00408d22
jmp 0x416760
push 0xff
mov ecx, esi
call fcn.00402840
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00408d45
jmp 0x416799
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x416799
push dword [esi]
push dword [ebp - 4]
call fcn.00417528
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41685f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0041690a
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4168a7
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00408d22
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00408d45
jmp 0x4168b2
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00417528
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x42211b
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.0043773c
call fcn.0040fa97
cmp dword [eax + 0x14], 0
jne 0x422136
mov ecx, esi
pop esi
jmp fcn.004214f9
pop esi
ret

Function at 0x435406
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.004a7ad3
call fcn.0040fa97
cmp dword [eax + 0x14], 0
jne 0x435421
mov ecx, esi
pop esi
jmp fcn.00434cef
pop esi
ret
Function at 0x532878
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x598030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.005270b5
mov dword [ebp - 0x14], eax
cmp dword [0x5acee8], esi
jne 0x53296b
push 0x800
push esi
push 0x574cc0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x5328f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x532a4b
push esi
push esi
push 0x574cc0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x532a4b
push 0x574cd8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x532a4b
push eax
call ebx
push 0x574ce4
push edi
mov dword [0x5acee8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x574cf4
push edi
mov dword [0x5aceec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x5acef0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5acef8], eax
test eax, eax
je 0x532968
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5acef4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x532990
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x532983
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x5329a5
push 4
pop eax
jmp 0x532a4d
cmp dword [ebp - 0x14], esi
je 0x5329a5
push dword [0x5acee8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x53298a
mov eax, dword [0x5acef4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x532a03
cmp dword [0x5acef8], edi
je 0x532a03
push eax
call ebx
push dword [0x5acef8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x532a03
test eax, eax
je 0x532a03
call ecx
test eax, eax
je 0x5329f8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x5329f8
test byte [ebp - 8], 1
jne 0x532a03
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x532a33
mov eax, dword [0x5aceec]
cmp eax, edi
je 0x532a30
push eax
call ebx
test eax, eax
je 0x532a30
call eax
mov esi, eax
test esi, esi
je 0x532a30
mov eax, dword [0x5acef0]
cmp eax, edi
je 0x532a30
push eax
call ebx
test eax, eax
je 0x532a30
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x5acee8]
call ebx
test eax, eax
je 0x532a4b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x532a4d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051fe74
mov esp, ebp
pop ebp
ret
Function at 0x572c80
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push eax
call sub.ws2_32.dll_connect
mov esp, ebp
pop ebp
ret

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x10051e1
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100d038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x1005244
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x100525e
and eax, 0xffff
or eax, 0x80070000
jmp 0x100525e
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x100522e
xor eax, eax
cmp dword [ebp - 0x14], ebx
sete al
mov esi, eax
cmp dword [ebp - 0x10], ebx
je 0x100526e
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01008732
leave
ret

Function at 0x1005573
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100d038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x1001510
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push eax
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
mov ecx, dword [ebp - 4]
add esp, 0xc
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.01008732
leave
ret 4
Function at 0x1005645
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x20
push 0x100c370
call fcn.01008748
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 0xc]
mov dword [edi], ebx
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
mov dword [ebp - 0x20], ebx
xor esi, esi
mov dword [ebp - 0x28], esi
or dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 4], ebx
cmp dword [ebp + 8], ebx
jne 0x1005680
mov dword [ebp - 0x1c], 0x80070057
jmp 0x1005780
push ebx
push 0x8000000
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
jne 0x10056c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.010079b3
push eax
call fcn.01007b3a
pop ecx
pop ecx
mov dword [ebp - 0x1c], 0xc0000017
jmp 0x1005780
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1005765
mov ecx, dword [ebp - 0x30]
add ecx, 0xffffffd0
mov eax, dword [ebp - 0x2c]
adc eax, 0xffffffff
cmp eax, ebx
ja 0x1005779
jb 0x10056f6
cmp ecx, 0xffff
ja 0x1005779
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x28], esi
push esi
call fcn.010054d4
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne 0x1005712
mov dword [ebp - 0x1c], 0x8007000e
jmp 0x1005780
push ebx
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1005765
cmp dword [ebp + 8], esi
jne 0x1005765
push esi
push dword [ebp - 0x20]
call fcn.0100922b
push eax
call fcn.010055ce
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jge 0x1005756
push eax
call fcn.010079b3
push eax
call fcn.01007b3a
pop ecx
pop ecx
mov dword [ebp - 0x1c], 0xc0000018
mov eax, dword [ebp - 0x20]
mov dword [edi], eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov dword [ebp - 0x20], ebx
jmp 0x1005780
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.010079b3
push eax
call fcn.01007b3a
pop ecx
pop ecx
mov dword [ebp - 0x1c], 0xc0000018
mov dword [ebp - 4], 0xfffffffe
call fcn.0100579c
mov eax, dword [ebp - 0x1c]
call fcn.0100878d
ret 0xc

Function at 0x1005cc6
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
xor edi, edi
inc edi
test byte [ecx + 0x28], 2
je 0x1005cdd
mov eax, dword [ecx + 8]
cmp eax, 0xffffffff
jne 0x1005ce1
xor edi, edi
jmp 0x1005d0a
mov ecx, dword [ecx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
dec ecx
test esi, ecx
jne 0x1005d07
push 0
lea ecx, [ebp + 0xc]
push ecx
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1005d07
cmp dword [ebp + 0xc], esi
je 0x1005d09
xor edi, edi
pop esi
mov eax, edi
pop edi
pop ebp
ret 8
Function at 0x1005ea6
Capabilities:
Clear file content

Disassembly:
push 0xc
push 0x100c3b0
call fcn.01008748
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
cmp dword [esi + 0x28], 2
je 0x1005ecb
mov dword [ebp - 0x1c], 0x80004005
jmp 0x1005f1d
push eax
mov edi, dword [ebp + 0xc]
push edi
mov ebx, dword [ebp + 8]
push ebx
mov ecx, esi
call fcn.01005d16
test eax, eax
jne 0x1005ef8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1005ef3
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x1c], eax
jmp 0x1005f1d
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1005edf
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], edi
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], edi
xor eax, eax
push eax
push eax
push eax
mov ecx, esi
call fcn.01005d16
mov dword [ebp - 4], 0xfffffffe
call fcn.01005f34
mov eax, dword [ebp - 0x1c]
call fcn.0100878d
ret 8

Function at 0x1006ebe
Capabilities:
Get common file path

Disassembly:
push 0x238
push 0x100c4d0
call fcn.010088fc
mov ebx, ecx
mov esi, 0x10015c0
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
mov word [ebp - 0x234], ax
push 0x206
xor edi, edi
push edi
lea eax, [ebp - 0x232]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x244], edi
mov dword [ebp - 0x238], edi
mov dword [ebp - 4], edi
cmp word [ebx + 0x48], di
je 0x100705a
mov esi, 0x104
push esi
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, edi
jne 0x1006f57
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1006f4c
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x238], eax
jmp 0x100705a
push 0x10015a8
push esi
lea eax, [ebp - 0x234]
push eax
call fcn.01006df0
mov dword [ebp - 0x238], eax
cmp eax, edi
jl 0x100705a
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x23c], eax
cmp eax, edi
je 0x100701e
push 0x1001598
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov edi, eax
push 0x1001580
push dword [ebp - 0x23c]
call esi
mov dword [ebp - 0x248], eax
push 0x1001570
push dword [ebp - 0x23c]
call esi
mov dword [ebp - 0x240], eax
test edi, edi
je 0x1007050
cmp dword [ebp - 0x248], 0
je 0x1007050
test eax, eax
je 0x1007050
mov ax, word [ebx + 0x48]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x244]
push eax
push 1
lea eax, [ebp - 0x2c]
push eax
call edi
mov dword [ebp - 0x238], eax
test eax, eax
jl 0x100705a
push dword [ebx + 0x4c]
mov esi, dword [ebp + 8]
push esi
push dword [ebp - 0x244]
call dword [ebp - 0x248]
mov dword [ebp - 0x238], eax
cmp eax, 0x80070001
jne 0x100702a
mov dword [ebp - 0x238], 1
jmp 0x100705a
test eax, eax
jge 0x100705a
push eax
neg esi
sbb esi, esi
and esi, 0x3fffffff
add esi, 0x8000002c
push esi
call fcn.010079b3
push eax
call fcn.01007b3a
add esp, 0xc
jmp 0x100705a
mov dword [ebp - 0x238], 0x80070001
mov dword [ebp - 4], 0xfffffffe
call fcn.01007074
mov eax, dword [ebp - 0x238]
call fcn.01008944
ret 4
Function at 0x10079da
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ecx]
sub esp, 0x18
cmp eax, 0xffffffff
je 0x1007a01
push 0
lea ecx, [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
add ecx, ecx
push ecx
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1007a54
cmp dword [ebp + 0x10], 0
push esi
push edi
je 0x1007a0d
push 0xfffffffffffffff4
jmp 0x1007a0f
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
je 0x1007a43
cmp word [ebp - 0x14], 0
je 0x1007a43
push 0
lea eax, [ebp + 0x10]
push eax
push 2
push 0x10015d0
push edi
call esi
push 0
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call esi
pop edi
pop esi
leave
ret 0xc

Function at 0x1007a5d
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi], 0xffffffff
mov byte [ebp - 4], 0xff
mov byte [ebp - 3], 0xfe
je 0x1007a7d
mov edi, 0x80004005
jmp 0x1007ac7
push edi
push 0x80000080
push 2
push edi
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x1007ab5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1007ab1
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x1007ac7
push edi
lea ecx, [ebp + 8]
push ecx
push 2
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, edi
pop edi
pop esi
leave
ret 4