joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e390
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x450008]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x41e3f5
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41e3d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41e3f5
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00432993
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.00432993
add esp, 8
ret 4
Function at 0x41eb40
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4389e8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x450008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x41eb89
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x41ecdb
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x41eca6
test eax, eax
je 0x41eca6
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x41eca9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x24], eax
cmp ecx, 0xffffffff
je 0x41ec2b
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41ec1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41ec2b
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x41ec39
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x24]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.00403f80
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x41eca6
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x41ebe4
jmp 0x41eca9
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
add dword [ecx], edx
test eax, eax
jne 0x41ecd2
test edx, edx
je 0x41ecce
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x41eba0
mov al, 1
jmp 0x41ecdd
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x41ecdb
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00432993
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41f43c
Capabilities:
Terminate thread

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
mov edi, ecx
cmp dword [edi + 0x64], 0
je 0x41f453
push dword [edi + 0x64]
call esi
cmp dword [edi + 0x70], 0
je 0x41f45e
push dword [edi + 0x70]
call esi
xor ebp, ebp
cmp dword [edi + 0x78], ebp
je 0x41f54c
push 0x450d14
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x78]
test al, 1
je 0x41f487
push dword [edi + 0x7c]
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov eax, dword [edi + 0x78]
test al, 2
je 0x41f49b
push dword [edi + 0x80]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler]
mov eax, dword [edi + 0x78]
pop ecx
test al, 4
je 0x41f4ac
push dword [edi + 0x84]
call dword [sym.imp.VCRUNTIME140.dll__set_purecall_handler]
pop ecx
mov ebx, dword [0x450d2c]
mov eax, dword [ebx + 4]
add eax, 0xfffffffc
cmp dword [eax], edi
jne 0x41f4c1
mov dword [ebx + 4], eax
jmp 0x41f512
push str.warning:_removing_Breakpad_handler_out_of_order_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
pop ecx
push eax
call fcn.0041f11b
mov ebx, dword [0x450d2c]
pop ecx
pop ecx
mov esi, dword [ebx]
mov eax, dword [ebx + 4]
cmp esi, eax
je 0x41f512
lea ebp, [esi + 4]
cmp dword [esi], edi
jne 0x41f503
mov eax, dword [ebx + 4]
sub eax, ebp
push eax
push ebp
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
add dword [ebx + 4], 0xfffffffc
jmp 0x41f509
add esi, 4
add ebp, 4
mov eax, dword [ebx + 4]
cmp esi, eax
jne 0x41f4e9
xor ebp, ebp
mov ecx, dword [ebx]
cmp ecx, eax
jne 0x41f541
test ecx, ecx
je 0x41f531
mov edx, dword [ebx + 8]
sub edx, ecx
and edx, 0xfffffffc
call fcn.00403800
mov dword [ebx], ebp
mov dword [ebx + 4], ebp
mov dword [ebx + 8], ebp
push 0xc
push ebx
call fcn.004329d4
pop ecx
pop ecx
mov dword [0x450d2c], ebp
push 0x450d14
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
cmp dword [edi + 0xc], ebp
jne 0x41f592
push 1
push dword [edi + 0x88]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 0x88]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
lea eax, [edi + 0x90]
mov dword [edi + 0x88], ebp
push eax
call ebx
push dword [edi + 0xa8]
call esi
push dword [edi + 0xac]
call esi
push 0x450d10
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x41f5a8
push 0x450d14
call ebx
lea ecx, [edi + 0xc0]
call fcn.004200e2
lea ecx, [edi + 0x40]
call fcn.00402f40
lea ecx, [edi + 0x28]
call fcn.00402f40
lea ecx, [edi + 0x10]
call fcn.00402f40
mov ecx, dword [edi + 0xc]
pop edi
pop esi
pop ebp
pop ebx
test ecx, ecx
je 0x41f5dc
push ecx
call fcn.00420138
ret
Function at 0x481c6e
Capabilities:
Check for software breakpoints

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop eax
mov ebx, 0x400000
mov esi, dword [ebx + 0xc0]
lea eax, [ebx + esi]
dec eax
mov cl, byte [eax]
cmp cl, 0xcc
je 0x481c82
sub eax, 3
mov edx, dword [eax]
mov esi, dword [ebx + 0x16c]
add esi, ebx
lea edi, [ebx + 0x1000]
push edi
mov ecx, edx
sub ecx, esi
push ecx
push esi
call fcn.00481b10
lea edx, [eax - 4]
sub edx, dword [edx]
mov esi, ebx
add esi, dword [edx + 0x10c]
mov edi, dword [edx + 0x104]
mov ecx, 0x1d63e
call fcn.00481c31
mov esi, dword [edx + 0x80]
push edx
add esi, ebx
mov eax, dword [esi + 0xc]
or eax, eax
je 0x481d19
add eax, ebx
push eax
call sub.kernel32.dll_LoadLibraryA
mov ebp, eax
mov ecx, dword [esi]
add ecx, ebx
mov edi, dword [esi + 0x10]
add edi, ebx
mov eax, dword [ecx]
or eax, eax
je 0x481d14
pushal
test eax, 0x80000000
je 0x481cfe
and eax, 0x7fffffff
jmp 0x481d02
lea eax, [ebx + eax + 2]
push eax
push ebp
call sub.kernel32.dll_GetProcAddress
mov dword [edi], eax
popal
add edi, 4
add ecx, 4
jmp 0x481ce9
add esi, 0x14
jmp 0x481ccf
pop edx
add ebx, dword [edx + 0x28]
jmp ebx
Function at 0x100010b0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
mov eax, 0xf40bc
call fcn.10013a80
mov eax, dword [0x1002acb0]
xor eax, esp
mov dword [esp + 0xf40b8], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
push esi
push edi
push 0
push 0
push 0
push 0
mov esi, ecx
call ebx
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
lea ecx, [esp + 0x20]
push ecx
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
test esi, esi
jbe 0x1000112f
xor byte [esp + eax + 0x14], 0x9c
inc eax
cmp eax, esi
jb 0x10001125
push 0x40
push 0x3000
push 0xf40b0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0xf40b0
lea edx, [esp + 0x18]
mov esi, eax
push edx
push esi
call fcn.1000ff70
add esp, 0xc
call dword [0x1002e8bc]
push 0
push 0
push 1
push 0
mov edi, eax
call ebx
push 0
push 0
push 0x64
push 0
push esi
mov ebx, eax
push edi
lea eax, [esp + 0x28]
push eax
call dword [0x1002e8c0]
test eax, eax
je 0x100011a6
push 0xffffffffffffffff
push ebx
call dword [0x1002e8b8]
test eax, eax
je 0x100011a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WaitForSingleObject_failed___d__n
call fcn.10010413
add esp, 8
mov ecx, dword [esp + 0xf40c4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000fdfc
add esp, 0xf40bc
ret

Function at 0x100011c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
mov eax, dword [0x1002acb0]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
xor ebx, ebx
lea eax, [esp + 8]
push eax
push ebx
push ebx
push 0x23
push ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
test eax, eax
je 0x10001204
push ebx
push 0x1002596b
jmp 0x1000121f
lea eax, [esp + 8]
lea edx, [eax + 1]
jmp 0x10001210
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10001210
sub eax, edx
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.100018b0
mov ecx, dword [esp + 0x10c]
pop ebx
xor ecx, esp
mov eax, esi
call fcn.1000fdfc
add esp, 0x10c
ret
Function at 0x10001240
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x10020fe1
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x1002acb0]
xor eax, esp
mov dword [esp + 0x164], eax
push ebx
push esi
push edi
mov eax, dword [0x1002acb0]
xor eax, esp
push eax
lea eax, [esp + 0x178]
mov dword fs:[0], eax
push 0x104
lea eax, [esp + 0x74]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
cmp eax, ebx
jle 0x100012b1
mov cl, 0x5c
nop
cmp byte [esp + eax + 0x70], cl
je 0x100012ad
dec eax
cmp eax, ebx
jg 0x100012a0
jmp 0x100012b1
mov byte [esp + eax + 0x71], bl
mov al, 0x74
lea edx, [esp + 0x64]
mov byte [esp + 0x69], al
mov byte [esp + 0x6b], al
push edx
lea eax, [esp + 0x74]
push eax
mov byte [esp + 0x6c], 0x61
mov byte [esp + 0x6d], 0x64
mov byte [esp + 0x6e], 0x6d
mov byte [esp + 0x6f], 0x65
mov byte [esp + 0x70], 0x2e
mov byte [esp + 0x72], 0x78
mov byte [esp + 0x74], bl
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea esi, [esp + 0x10]
call fcn.100011c0
push eax
mov edi, 0x100259f8
lea esi, [esp + 0x30]
mov dword [esp + 0x184], ebx
call fcn.10001bf0
push eax
lea edi, [esp + 0x6c]
lea esi, [esp + 0x50]
mov byte [esp + 0x188], 1
call fcn.10001bf0
add esp, 8
mov esi, 0x10
cmp dword [esp + 0x44], esi
jb 0x1000133d
mov ecx, dword [esp + 0x30]
push ecx
call fcn.10002022
add esp, 4
mov edi, 0xf
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
mov byte [esp + 0x180], 4
cmp dword [esp + 0x28], esi
jb 0x10001369
mov edx, dword [esp + 0x14]
push edx
call fcn.10002022
add esp, 4
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
cmp dword [esp + 0x60], esi
jae 0x10001383
lea eax, [esp + 0x4c]
push ebx
push eax
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x70]
call fcn.100010b0
cmp dword [esp + 0x60], esi
jb 0x100013ac
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.10002022
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x178]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.1000fdfc
add esp, 0x174
ret

Function at 0x1000fdfc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002acb0]
jne 0x1000fe06
repz ret
jmp fcn.10013d7a
Function at 0x1001b9b1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10014278
and dword [ebp - 4], 0
cmp dword [0x1002e844], 0
mov ebx, eax
jne 0x1001ba62
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1001bb13
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10024f28
push edi
call esi
test eax, eax
je 0x1001bb13
push eax
call fcn.10014206
mov dword [esp], 0x10024f18
push edi
mov dword [0x1002e844], eax
call esi
push eax
call fcn.10014206
mov dword [esp], 0x10024f04
push edi
mov dword [0x1002e848], eax
call esi
push eax
call fcn.10014206
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1002e84c], eax
call esi
push eax
call fcn.10014206
pop ecx
mov dword [0x1002e854], eax
test eax, eax
je 0x1001ba62
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10014206
pop ecx
mov dword [0x1002e850], eax
mov eax, dword [0x1002e850]
cmp eax, ebx
je 0x1001baba
cmp dword [0x1002e854], ebx
je 0x1001baba
push eax
call fcn.10014281
push dword [0x1002e854]
mov esi, eax
call fcn.10014281
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1001baba
test edi, edi
je 0x1001baba
call esi
test eax, eax
je 0x1001bab1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001bab1
test byte [ebp - 0xc], 1
jne 0x1001baba
or dword [ebp + 0x10], 0x200000
jmp 0x1001baf3
mov eax, dword [0x1002e848]
cmp eax, ebx
je 0x1001baf3
push eax
call fcn.10014281
pop ecx
test eax, eax
je 0x1001baf3
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001baf3
mov eax, dword [0x1002e84c]
cmp eax, ebx
je 0x1001baf3
push eax
call fcn.10014281
pop ecx
test eax, eax
je 0x1001baf3
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1002e844]
call fcn.10014281
pop ecx
test eax, eax
je 0x1001bb13
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001bb15
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x516ca0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0xc0000]
push edi
or ebp, 0xffffffff
jmp 0x516cc2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x516cc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x516cb8
mov eax, 1
add ebx, ebx
jne 0x516cdb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x516cec
jne 0x516cfc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x516cfc
dec eax
add ebx, ebx
jne 0x516cf8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x516cd0
xor ecx, ecx
sub eax, 3
jb 0x516d14
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x516d86
sar eax, 1
mov ebp, eax
jmp 0x516d1f
add ebx, ebx
jne 0x516d1f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x516d2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x516d50
inc ecx
add ebx, ebx
jne 0x516d3c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x516d31
jne 0x516d4d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x516d31
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x516d70
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x516d61
jmp 0x516cbe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x516d70
add edi, ecx
jmp 0x516cbe
pop esi
mov edi, esi
mov ecx, 0xc9c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x516d8e
cmp byte [edi], 0xe
jne 0x516d8e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x516d93
lea edi, [esi + 0x114000]
mov eax, dword [edi]
or eax, eax
je 0x516e0b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x116768]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1167a4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x516dc0
mov ecx, edi
jns 0x516def
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1167a8]
or eax, eax
je 0x516e05
mov dword [ebx], eax
add ebx, 4
jmp 0x516ddd
call dword [esi + 0x1167ac]
popal
jmp 0x406bf4
Function at 0x3aa94ad4
Capabilities:
Delete registry key

Disassembly:
push 0x30
mov eax, 0x3ab4b5b9
call fcn.3ab35a13
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edi
lea edx, [ebp - 0x34]
add eax, 0x88c
push edx
mov byte [ebp - 4], 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x30]
call fcn.3ab3c1f6
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x3aa94b18
lea eax, [ebp - 0x2c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.advapi32.dll_RegDeleteKeyW]
push edi
push 1
lea ecx, [ebp - 0x30]
call fcn.3ab3c1f6
push dword [ebp - 0x34]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
call fcn.3ab35a7e
ret 4

Function at 0x3aa99674
Capabilities:
Connect pipe
Create pipe

Disassembly:
mov edi, edi
push edi
xor edi, edi
push edi
push edi
mov eax, 0x400
push eax
push eax
push 1
push edi
push 0x40080003
push dword [esi + 0xc]
call dword [sym.imp.kernel32.dll_CreateNamedPipeW]
mov dword [esi + 0x10], eax
cmp eax, 0xffffffff
jne 0x3aa996a8
and dword [esi + 0x10], edi
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
jmp 0x3aa996f7
lea ecx, [esi + 0x1c]
push ecx
push eax
call dword [sym.imp.kernel32.dll_ConnectNamedPipe]
test eax, eax
je 0x3aa996bd
mov byte [esi + 0x39], 1
jmp 0x3aa996f7
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
cmp edi, 0xe7
jne 0x3aa996e9
push 0x4e20
push dword [esi + 0xc]
xor edi, edi
call dword [sym.imp.kernel32.dll_WaitNamedPipeW]
test eax, eax
jne 0x3aa996b7
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
cmp edi, 0x3e5
jne 0x3aa996f7
xor edi, edi
mov byte [esi + 0x38], 1
mov eax, edi
pop edi
ret

Function at 0x3aa9cb86
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x20
mov eax, 0x3ab4698a
call fcn.3ab359d8
mov eax, dword [ebp + 8]
push eax
mov esi, ecx
push esi
lea eax, [ebp - 0x2c]
push eax
call fcn.3ab1628c
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x3aa9cbb2
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.3ab18e4a
cmp dword [esi + 0x18], 8
jb 0x3aa9cbc5
mov esi, dword [esi + 4]
jmp 0x3aa9cbc8
add esi, 4
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x3aa9cbd8
xor eax, eax
jmp 0x3aa9cbdb
or eax, 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
mov word [edi], ax
call fcn.3ab3c1f6
call fcn.3ab35a6a
ret 4
Function at 0x3aa9d407
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Set file attributes

Disassembly:
push 0xa0
mov eax, 0x3ab4af92
call fcn.3ab3599d
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push edi
mov byte [ebp - 0x11], 1
call fcn.3ab3c1f6
test al, al
je 0x3aa9d48a
push edi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
push edi
call dword [sym.imp.kernel32.dll_DeleteFileW]
xor ebx, ebx
test eax, eax
jne 0x3aa9d48c
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
push 0x400
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push ebx
push 0x1300
call dword [sym.imp.kernel32.dll_FormatMessageW]
push ebx
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x18]
call fcn.3ab3c1f6
call fcn.3aab5930
push dword [ebp - 0x18]
call dword [sym.imp.kernel32.dll_LocalFree]
jmp 0x3aa9d48c
xor ebx, ebx
push 2
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x3aa9d5e2
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.kernel32.dll_CopyFileExW]
test eax, eax
jne 0x3aa9d5bb
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
push 0x400
mov byte [ebp - 0x11], bl
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push ebx
push 0x1300
call dword [sym.imp.kernel32.dll_FormatMessageW]
push ebx
push 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x20], esp
push dword [ebp - 0x18]
call fcn.3ab3c1f6
call fcn.3aab5930
push dword [ebp - 0x18]
call dword [sym.imp.kernel32.dll_LocalFree]
jmp 0x3aa9d5d2
push edi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x3aa9d5d2
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov al, byte [ebp - 0x11]
call fcn.3ab35a51
ret 0xc
Function at 0x3aaa07fe
Capabilities:
Enumerate files on windows

Disassembly:
push 0x40c
mov eax, 0x3ab45f4f
call fcn.3ab359d8
push dword [0x3ab78660]
lea eax, [ebp - 0x1c0]
push eax
call fcn.3ab16131
xor esi, esi
push 0x3aa65ac4
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 4], esi
call fcn.3ab3c1f6
cmp dword [ebp - 0x1a8], 8
mov eax, dword [ebp - 0x1bc]
jae 0x3aaa0849
lea eax, [ebp - 0x1bc]
lea ecx, [ebp - 0x414]
push ecx
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x3aaa087e
add esi, dword [ebp - 0x3f4]
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x3aaa085e
cmp esi, 0x100000
ja 0x3aaa0883
mov esi, 0x100001
xor eax, eax
push 0x18e
push eax
mov word [ebp - 0x1a4], ax
lea eax, [ebp - 0x1a2]
push eax
add esi, 0x500000
call fcn.3ab033f0
push esi
push 0x3aa665ac
push 0xffffffffffffffff
lea eax, [ebp - 0x1a4]
push 0xc8
push eax
call fcn.3ab3c1f6
add esp, 0x20
lea eax, [ebp - 0x1a4]
push eax
lea ecx, [ebp - 0x418]
call fcn.3ab3c1f6
mov byte [ebp - 4], 1
push dword [ebp - 0x418]
lea eax, [edi + 0x58c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
push dword [ebp - 0x418]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0
push 1
lea ecx, [ebp - 0x1c0]
call fcn.3ab3c1f6
call fcn.3ab35a6a
ret