joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431f4a
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov eax, 0x4d5dc0
call fcn.00476d58
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
push 0x57cd3c
lea ecx, [ebp - 0x10]
call fcn.004b92f2
xor edi, edi
xor ebx, ebx
cmp dword [esi + 0x14], edi
mov dword [ebp - 4], edi
jle 0x431fdb
cmp ebx, edi
jl 0x431f78
cmp ebx, dword [esi + 0x14]
jge 0x431f78
mov eax, dword [esi + 0x10]
mov eax, dword [eax + ebx*4]
jmp 0x431f7a
xor eax, eax
cmp dword [eax + 0x74], 0x64
jne 0x431fd5
cmp dword [eax + 0x80], 0x64
jne 0x431fd5
push dword [eax + 0x5c8]
lea edi, [eax + 0x5c8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x431fd3
test ebx, ebx
jle 0x431fb0
push 0x5008c0
lea ecx, [ebp - 0x10]
call fcn.004b966f
push 0x5008bc
lea ecx, [ebp - 0x10]
call fcn.004b966f
push edi
lea ecx, [ebp - 0x10]
call fcn.004b96ab
push 0x5008bc
lea ecx, [ebp - 0x10]
call fcn.004b966f
xor edi, edi
inc ebx
cmp ebx, dword [esi + 0x14]
jl 0x431f67
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], edi
je 0x43201e
lea eax, [ebp - 0x14]
push eax
call fcn.00401f8b
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
push 1
push edi
je 0x432006
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push edi
jmp 0x43200f
push edi
push dword [ebp - 0x10]
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x14]
call fcn.004b927e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004b927e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x45276e
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x4d84ce
call fcn.00476d58
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0045281b
mov eax, dword [0x575528]
lea ecx, [esi + 0x14]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ecx], eax
mov eax, dword [0x575528]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0x4e1b6c
mov dword [esi + 0x20], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x24], ebx
mov eax, dword [0x575528]
mov dword [esi + 0x3c], eax
mov eax, dword [0x575528]
mov dword [esi + 0x40], eax
mov eax, dword [0x575528]
mov dword [esi + 0x44], eax
mov edi, 0x57cd3c
mov byte [ebp - 4], 6
push edi
mov dword [esi], 0x4e1b60
call fcn.004b9415
push edi
lea ecx, [esi + 0x18]
call fcn.004b9415
push edi
lea ecx, [esi + 0x3c]
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call fcn.004b9415
push edi
lea ecx, [esi + 0x40]
call fcn.004b9415
push edi
lea ecx, [esi + 0x44]
call fcn.004b9415
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x459bf4
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4d8b0b
call fcn.00476d58
sub esp, 0xe4
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
je 0x459d52
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x459d52
lea ecx, [ebp - 0xf0]
call fcn.004200f2
push ebx
push 0x74
push dword [ebp + 8]
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0xf0]
mov dword [ebp - 4], ebx
push eax
call fcn.0042025b
mov ecx, eax
call fcn.004200ea
test al, al
jne 0x459c59
or esi, 0xffffffff
jmp 0x459d24
lea eax, [ebp - 0x10]
push str.MediaFormats
push eax
lea ecx, [ebp - 0xf0]
call fcn.0041fd1b
lea ecx, [ebp - 0x10]
call fcn.004200ea
test al, al
jne 0x459c51
push 0x57cd3c
lea eax, [ebp - 0x1c]
push 0x501558
push eax
lea ecx, [ebp - 0x10]
call fcn.0041fd62
mov ecx, eax
call fcn.0041fbb5
push eax
lea ecx, [ebp - 0x14]
call fcn.004b92f2
mov esi, dword [ebp + 0xc]
mov byte [ebp - 4], 1
push dword [esi + 4]
push dword [ebp - 0x14]
call fcn.00476e15
pop ecx
test eax, eax
pop ecx
je 0x459cbc
push 1
pop esi
jmp 0x459d18
lea eax, [ebp - 0x18]
push str.Categories
push eax
lea ecx, [ebp - 0x10]
call fcn.0041fd1b
lea ecx, [ebp - 0x18]
call fcn.004200ea
test al, al
je 0x459cde
or esi, 0xffffffff
jmp 0x459d18
cmp dword [esi + 0x10], ebx
jle 0x459d16
mov eax, dword [esi + 0xc]
lea ecx, [ebp - 0x18]
mov edi, dword [eax + ebx*4]
lea eax, [ebp + 8]
push dword [edi + 8]
push eax
call fcn.0041fd1b
lea ecx, [ebp + 8]
call fcn.004200ea
test al, al
jne 0x459d37
lea eax, [ebp + 8]
push eax
push edi
call fcn.00459d66
inc ebx
pop ecx
cmp ebx, dword [esi + 0x10]
pop ecx
jl 0x459ce3
xor esi, esi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004b927e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0]
call fcn.00420109
mov eax, esi
jmp 0x459d55
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004b927e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0]
call fcn.00420109
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x48e810
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00477b60
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x48e8db
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x48e8db
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x48e88e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x48e899
or bh, 8
and edi, 0x8000000
je 0x48e8b4
mov eax, dword [0x580cfc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x48e8db
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bb09a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4bb0d2
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b973c
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b9713
jmp 0x4bb0de
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4bb0e2
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x57d3e0
mov ecx, edi
call fcn.004b9415
cmp dword [esi + 0x34], 0
push dword [esp + 0xc]
jne 0x4bb135
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x4bb148
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.004b973c
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, edi
call fcn.004b9713
jmp 0x4bb148
mov ecx, esi
call fcn.004bd273
test eax, eax
je 0x4bb148
push edi
mov ecx, eax
call fcn.004bb09a
mov eax, dword [edi]
pop edi
pop esi
mov eax, dword [eax - 8]
ret 8

Function at 0x4bc9eb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4bca2d
call fcn.004cd8b0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x4bca2d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4bca24
xor eax, eax
jmp 0x4bca35
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004bca3b
pop edi
pop esi
pop ebx
ret 4
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7ba50b36
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x15d62d43
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x415407
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x415416
pop dword [ebp - 0x38]
mov eax, 0x415416
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x93df9bb7
sub dword [ebp - 0x48], 0x458d566c
mov dword [ebp - 0x44], 0x698e2d11
sub dword [ebp - 0x44], 0x375ae0cc
mov dword [ebp - 0x40], 0xad1bc2a7
add dword [ebp - 0x40], 0x9f308187
mov dword [ebp - 0x3c], 0xe6a4f661
sub dword [ebp - 0x3c], 0xe6a4f661
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xb4630eb
sub dword [ebp - 0x48], 0x96d3c795
mov dword [ebp - 0x44], 0x1ef3a873
sub dword [ebp - 0x44], 0xdd8746fe
mov dword [ebp - 0x40], 0x597dc1ef
sub dword [ebp - 0x40], 0xf60e5583
mov dword [ebp - 0x3c], 0xd688c840
sub dword [ebp - 0x3c], 0xd688c840
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xccc685ca
sub eax, 0xcc8504f2
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3a317
push 0
call eax
mov ecx, 0x4ef1
mov ebx, eax
mov esi, 0x429600
add esi, dword [ebp - 0x38]
mov edi, 0xb71d4cd2
add edi, 0x80cbb022
mov dword [ebp - 0x2c], 0x25afef28
mov edx, dword [esi]
xor dword [ebp - 0x24], 0x6804ffef
xor edx, edi
sub dword [ebp - 0x2c], ebx
mov dword [ebx], edx
sub dword [ebp - 8], 0xe3c99db6
add ebx, 4
add esi, 0x26c3bba8
add esi, 0xd93c445c
loop 0x415522
add eax, 0x12e97
mov ebx, eax
add eax, 0x5a77e271
add eax, 0xa5881d94
mov ecx, 0x2bf467b3
add ecx, 0xd44b984d
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x402c00
pop dword [ebp - 0x38]
mov eax, 0x402c00
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x2f55b6a2
sub dword [ebp - 0x48], 0xe1037157
mov dword [ebp - 0x44], 0x5705670a
sub dword [ebp - 0x44], 0x24d21ac5
mov dword [ebp - 0x40], 0xc1296c0d
add dword [ebp - 0x40], 0x8b22d821
mov dword [ebp - 0x3c], 0x4e2e0a2
add dword [ebp - 0x3c], 0xfb1d1f5e
lea eax, [ebp - 0x48]
push eax
mov eax, 0xe6900eef
add eax, 0x19b0719d
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x13466e25
sub dword [ebp - 0x48], 0x9ed404cf
mov dword [ebp - 0x44], 0x9bed87ec
sub dword [ebp - 0x44], 0x5a812677
mov dword [ebp - 0x40], 0x676ad748
sub dword [ebp - 0x40], 0x3fb6adc
mov dword [ebp - 0x3c], 0xd106e4c0
add dword [ebp - 0x3c], 0x2ef91b40
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3c8aa
push 0
call eax
mov ecx, 0x3dbbe748
sub ecx, 0x3dbb87df
xor esi, esi
add esi, eax
mov edx, 0xbe364a31
sub edx, 0xbdf53a31
add edx, dword [ebp - 0x38]
mov edi, 0xe6986e74
sub dword [ebp - 4], edx
mov ebx, dword [edx]
xor dword [ebp - 8], 0x2b1bf226
xor ebx, edi
sub dword [ebp - 0x1c], edi
mov dword [esi], ebx
xor dword [ebp - 0x34], ebx
add esi, 0x6ce207c1
sub esi, 0x6ce207bd
add edx, 4
loop 0x402d14
add eax, 0x17077
xor ebx, ebx
add ebx, eax
add eax, 0xe69987d9
add eax, 0x1966782c
mov ecx, 0x1898eaf1
sub ecx, 0x1858eaf1
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x1001fd54
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001fe8e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1001fd94
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jg 0x1001fe8c
mov dword [ebp - 0xc], 0xfffffff9
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001fdc0
push 0xf07
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
imul eax, dword [ecx]
test eax, eax
jne 0x1001fddc
mov eax, 0xfffe
test eax, eax
jne 0x1001fddc
and dword [ebp - 0x10], 0
jmp 0x1001fde3
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jl 0x1001fdf4
mov dword [ebp - 0x14], 1
jmp 0x1001fdf8
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
jl 0x1001fe0d
mov dword [ebp - 0x18], 1
jmp 0x1001fe11
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
jge 0x1001fe24
mov dword [ebp - 0x1c], 1
jmp 0x1001fe28
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
cmp eax, dword [ecx]
jne 0x1001fe3e
mov dword [ebp - 0x28], 1
jmp 0x1001fe42
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.10019c33
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.10019c33
mov ecx, dword [ebp - 0x24]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x28]
jge 0x1001fe79
mov dword [ebp - 0x2c], 1
jmp 0x1001fe7d
and dword [ebp - 0x2c], 0
imul eax, dword [ebp - 0x2c], 0x3293
mov dword [ebp - 0xc], eax
jmp 0x1001fd89
jmp 0x1001fea7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov edx, 0x2c0b0945
mov ecx, dword [ebp - 0x3c]
call fcn.1001fc94
mov esp, ebp
pop ebp
ret
Function at 0x100317e6
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100317fc
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x10031841
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
push 0x5ecf
mov eax, dword [ebp - 0x10]
push dword [eax]
push 0xeb6
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push dword [eax]
push 1
call fcn.1002f332
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x10038851
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10038897
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x18]
mov dword [eax], ecx
jmp 0x100388ba
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x100388ba
push 0xf07
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret
Function at 0x100389cb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x100389ef
xor eax, eax
jmp 0x10038b19
lea eax, [ebp - 0x10]
push eax
push 0x4e90
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp + 8]
push eax
call fcn.10038851
add esp, 0x14
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10038a1c
xor eax, eax
jmp 0x10038b19
lea eax, [ebp - 0xc]
push eax
push 1
push dword [ebp - 8]
call fcn.100385ff
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x10038a3a
xor eax, eax
jmp 0x10038b19
push 0x475c
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x23be
call fcn.100388be
add esp, 0x20
push dword [ebp - 8]
push 0x1fa4
push dword [ebp + 8]
push 0
push 0x2ad0
push 0x5442
push dword [ebp - 4]
call fcn.1003045e
add esp, 0x1c
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x1c], ecx
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1003897d
add esp, 0xc
push dword [ebp - 4]
call fcn.100384c4
pop ecx
test eax, eax
jne 0x10038ab3
xor eax, eax
jmp 0x10038b19
push dword [ebp - 4]
push 0
call fcn.100319ab
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10038b01
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
jne 0x10038ade
xor eax, eax
jmp 0x10038b19
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10038af7
xor eax, eax
jmp 0x10038b19
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10038b12
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x10038b16
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x10051759
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100518e5
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
mov dword [eax], 0xffffffff
or eax, 0xffffffff
cmp eax, 0x647c2c9e
je 0x100517b7
mov dword [ebp - 0x1c], 1
jmp 0x100517bb
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x100517cd
xor eax, eax
jne 0x100517cd
and dword [ebp - 0x10], 0
jmp 0x100517d4
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx]
jle 0x100517ec
mov dword [ebp - 0x14], 1
jmp 0x100517f0
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
cmp eax, 0xfffffffd
jne 0x10051806
mov dword [ebp - 0xc], 1
jmp 0x1005180a
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
cmp dword [ebp - 0xc], 0xf08700d3
jb 0x10051824
mov dword [ebp - 0x18], 1
jmp 0x10051828
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
jne 0x1005183b
mov dword [ebp - 0x20], 1
jmp 0x1005183f
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jl 0x10051864
mov dword [ebp - 0x2c], 1
jmp 0x10051868
and dword [ebp - 0x2c], 0
cmp dword [ebp - 0x2c], 0x8cc19583
je 0x1005187a
mov dword [ebp - 0x30], 1
jmp 0x1005187e
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
imul eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx]
jl 0x10051897
mov dword [ebp - 0x34], 1
jmp 0x1005189b
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x34], eax
jg 0x100518b6
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x100518b6
mov dword [ebp - 0x38], 1
jmp 0x100518ba
and dword [ebp - 0x38], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x38], eax
jle 0x100518cd
mov dword [ebp - 0x4c], 1
jmp 0x100518d1
and dword [ebp - 0x4c], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x100518ed
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esp, ebp
pop ebp
ret
Function at 0x100671d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.10067260
movzx eax, al
test eax, eax
je 0x10067201
push 0x10001358
push 0x14b2d380
call fcn.10061820
add esp, 8
push 0
call fcn.1007a6ee
mov ecx, dword [ebp - 4]
call fcn.10067520
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 4]
call fcn.10067350
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret