joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30f34d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
mov edi, dword [esp + 0x74]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x30f34f0
cmp eax, 0xffffffdd
jge 0x30f3507
mov eax, 0xffffffff
jmp 0x30f350a
add eax, 0x22
push eax
call fcn.030dc610
add esp, 4
mov esi, eax
mov dword [esp + 0x18], 0x21ab27c0
mov dword [esp + 0x1c], 0xddb323ac
mov dword [esp + 0x20], 0xd93ddf4e
mov dword [esp + 0x24], 0xd545db41
mov dword [esp + 0x28], 0xd14ad730
mov dword [esp + 0x2c], 0xcd4cd34f
mov dword [esp + 0x30], 0xc941cf2f
mov dword [esp + 0x34], 0xc546cb5c
mov word [esp + 0x38], 0xc7c4
mov dword [esp + 0x3a], 0
mov word [esp + 0x3e], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x27
ja 0x30f35ab
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x18]
push dword [esp + 4]
push eax
call fcn.030f4370
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x28
jb 0x30f3580
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x30f35d1
add ecx, 2
mov eax, esi
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x30f35c0
mov word [eax], 0
movzx ecx, word [esp + 0x18]
test cx, cx
je 0x30f3601
lea edx, [esp + 0x1a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x30f35f0
mov word [eax], 0
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0xf745f94d
mov dword [esp + 0x1c], 0xf387f572
mov dword [esp + 0x20], 0xcf46f14d
mov dword [esp + 0x24], 0xcb77cd40
mov dword [esp + 0x28], 0xc749c97a
mov dword [esp + 0x2c], 0xc371c57d
mov dword [esp + 0x30], 0xdfa9c172
mov dword [esp + 0x34], 0xdbadddab
mov dword [esp + 0x38], 0xd774d9ae
mov dword [esp + 0x3c], 0xd35dd559
mov dword [esp + 0x40], 0x2fa0d16d
mov dword [esp + 0x44], 0x2b992d73
mov dword [esp + 0x48], 0x27aa299a
mov dword [esp + 0x4c], 0x23aa2599
mov dword [esp + 0x50], 0x3f6721ac
mov dword [esp + 0x54], 0x3b7f3d80
mov dword [esp + 0x58], 0x3736394e
mov byte [esp + 0x5c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x44
ja 0x30f36e6
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0x18]
push dword [esp]
push eax
call fcn.030f43e0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0x18], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x45
jb 0x30f36c0
lea eax, [esp + 4]
lea ecx, [esp + 0x18]
push eax
push 0x30f39d0
push ecx
push esi
call fcn.030f45d0
add esp, 0x10
jmp dword [0x3120200]
Function at 0x30f78d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x4c
mov esi, dword [0x3124fa0]
mov dword [esp + 4], 0x1353113d
mov dword [esp + 8], 0x1f8e1d8c
mov dword [esp + 0xc], 0x1b7b1954
mov dword [esp + 0x10], 0x7670598
mov dword [esp + 0x14], 0x366012d
mov dword [esp + 0x18], 0xf660d70
mov dword [esp + 0x1c], 0xb9c0995
mov dword [esp + 0x20], 0x375b3558
mov dword [esp + 0x24], 0x335031a2
mov dword [esp + 0x28], 0x3fac3d55
mov dword [esp + 0x2c], 0x3b5e3954
mov dword [esp + 0x30], 0x27b42554
mov dword [esp + 0x34], 0x234c21b7
mov dword [esp + 0x38], 0x2fba2d45
mov dword [esp + 0x3c], 0x2bb92945
mov word [esp + 0x40], 0x5554
mov dword [esp + 0x42], 0
mov word [esp + 0x46], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x43
ja 0x30f79a6
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.030f99a0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x44
jb 0x30f7980
lea ebx, [esp + 0x48]
lea eax, [esp + 4]
push ebx
push 0
push 0
push 0x1e
push eax
push 0
call esi
mov ebp, dword [esp + 0x48]
test ebp, ebp
jns 0x30f79c9
mov eax, 0xffffffff
jmp 0x30f79d0
lea eax, [ebp*2]
push eax
call fcn.030dc610
add esp, 4
mov esi, eax
mov edi, dword [0x3124fa0]
mov dword [esp + 4], 0x21e527fb
mov dword [esp + 8], 0xddb223b0
mov dword [esp + 0xc], 0xd93ddf20
mov dword [esp + 0x10], 0xd539db54
mov dword [esp + 0x14], 0xd132d70b
mov dword [esp + 0x18], 0xcd4ad33c
mov dword [esp + 0x1c], 0xc958cf43
mov dword [esp + 0x20], 0xc555cb54
mov dword [esp + 0x24], 0xc124c756
mov dword [esp + 0x28], 0xfd50c35b
mov dword [esp + 0x2c], 0xf91aff60
mov dword [esp + 0x30], 0xf568fb08
mov dword [esp + 0x34], 0xf168f765
mov dword [esp + 0x38], 0xed66f36b
mov dword [esp + 0x3c], 0xe963ef73
mov dword [esp + 0x40], 0xebe8
mov byte [esp + 0x44], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x40
ja 0x30f7aa6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.030f9a30
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x41
jb 0x30f7a80
push ebx
push ebp
push esi
push 0x1e
lea ebx, [esp + 0x14]
push ebx
push 0
call edi
mov dword [esp + 4], 0x89328b20
mov dword [esp + 8], 0x85348703
mov dword [esp + 0xc], 0x81398338
mov dword [esp + 0x10], 0x9d209f0e
mov dword [esp + 0x14], 0x99149b2b
mov dword [esp + 0x18], 0x95969724
mov byte [esp + 0x1c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x18
ja 0x30f7b26
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.030f9ac0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x19
jb 0x30f7b00
push 0
push 0
push ebx
push esi
push dword [esp + 0x70]
call fcn.030f1d60
add esp, 0x14
jmp dword [0x3120854]
Function at 0x3105b80
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2e0
mov dword [esp + 0x2b4], 0x3121ce4
mov dword [esp + 0xa4], 0
lea eax, [esp + 0xa4]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x311cc50
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x311cc60
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x2b0], eax
mov eax, dword [esp + 0x2b4]
mov ecx, dword [esp + 0x2b0]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x2ac], 0x3121cec
mov dword [esp + 0x2a4], 0x3121cf4
mov dword [esp + 0x29c], 0x3121cfc
mov dword [esp + 0x294], 0x3121d04
mov dword [esp + 0x28c], 0x3121d0c
mov dword [esp + 0x284], 0x3121570
mov dword [esp + 0x280], 0x96
mov dword [esp + 0x27c], 0x3121d14
mov dword [esp + 0x274], 0x3121d1c
mov dword [esp + 0x26c], 0x3121d24
mov dword [esp + 0x264], 0x3121570
mov dword [esp + 0x260], 0x9d
mov dword [esp + 0x25c], 0x3121d2c
mov dword [esp + 0x254], 0x3121d34
mov dword [esp + 0x24c], 0x3121570
mov dword [esp + 0x248], 0x9d
mov dword [esp + 0x244], 0x3121d3c
mov dword [esp + 0x23c], 0x3121570
mov dword [esp + 0x238], 0x9f
mov dword [esp + 0x234], 0x3121d44
mov dword [esp + 0x22c], 0x3121d4c
mov dword [esp + 0x224], 0x3121570
mov dword [esp + 0x220], 0xa2
mov dword [esp + 0x21c], 0x3121d54
mov dword [esp + 0x214], 0x3121d5c
mov dword [esp + 0x20c], 0x3121d64
mov dword [esp + 0x204], 0x3121570
mov dword [esp + 0x200], 0xa6
mov dword [esp + 0x1fc], 0x3121d6c
mov dword [esp + 0x1f4], 0x3121570
mov dword [esp + 0x1f0], 0xa8
mov dword [esp + 0x1ec], 0x3121d74
mov dword [esp + 0x1e4], 0x3121570
mov dword [esp + 0x1e0], 0xaa
mov dword [esp + 0x1dc], 0x3121570
mov dword [esp + 0x1d8], 0xab
mov dword [esp + 0x1d4], 0x3121570
mov dword [esp + 0x1d0], 0xac
mov dword [esp + 0x1cc], 0x3121d7c
mov dword [esp + 0x1c4], 0x3121570
mov dword [esp + 0x1c0], 0xae
mov dword [esp + 0x1bc], 0x3121570
mov dword [esp + 0x1b8], 0xaf
mov dword [esp + 0x1b4], 0x3121570
mov dword [esp + 0x1b0], 0xb0
mov dword [esp + 0x1ac], 0x3121570
mov dword [esp + 0x1a8], 0xb1
mov dword [esp + 0x1a4], 0x3121570
mov dword [esp + 0x1a0], 0xb2
mov dword [esp + 0x19c], 0x3121570
mov dword [esp + 0x198], 0xb3
mov dword [esp + 0x194], 0x3121d84
mov dword [esp + 0x18c], 0x3121d8c
mov dword [esp + 0x184], 0x3121570
mov dword [esp + 0x180], 0x94
mov dword [esp + 0x17c], 0x3121570
mov dword [esp + 0x178], 0x98
mov dword [esp + 0x174], 0x3121570
mov dword [esp + 0x170], 0x9b
mov dword [esp + 0x16c], 0x3121570
mov dword [esp + 0x168], 0xa0
mov dword [esp + 0x164], 0x3121570
mov dword [esp + 0x160], 0xa3
mov dword [esp + 0x15c], 0x3121570
mov dword [esp + 0x158], 0xb4
xor esi, esi
jmp eax
Function at 0x3107400
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x3107565
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
jmp 0x3107452
cmp edi, 0
setne al
jmp 0x310745a
xor ebx, ebx
test al, 1
jne 0x3107465
jmp 0x310755d
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov esi, eax
mov dword [esp], esi
call fcn.030dc720
mov ebp, eax
cmp ebp, 0
setne al
xor ebx, ebx
test al, 1
jne 0x310748e
jmp 0x310754f
mov al, byte [esp + 0x10]
mov byte [esp + 0x14], al
mov byte [esp + 0x18], 0x8f
mov byte [esp + 0x19], 0x55
mov byte [esp + 0x1a], 0x57
mov byte [esp + 0x1b], 0x5f
mov byte [esp + 0x1c], 0xaa
mov byte [esp + 0x1d], 0x5e
mov byte [esp + 0x1e], 0xa3
mov byte [esp + 0x1f], 0x55
mov byte [esp + 0x20], 0xa4
mov byte [esp + 0x21], 0x93
mov byte [esp + 0x22], 0x52
mov byte [esp + 0x23], 0x4f
mov byte [esp + 0x24], 0x50
mov byte [esp + 0x25], 0xc5
mov eax, 0xe
mov byte [esp + eax + 0x18], 0
add eax, 1
cmp eax, 0x11
jne 0x31074e1
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x11
jae 0x310752b
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esp + ecx + 0x18]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0310b2f0
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x18], al
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
jmp 0x31074f6
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
call fcn.030dd3a0
sub esp, 0xc
mov bl, al
and bl, 1
jmp 0x310754d
jmp 0x310754f
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x310755d
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x3107565
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x3117bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 8], 0xd1cecf3c
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x3117c06
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 8]
push dword [esp]
push eax
call fcn.03119f70
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x3117be0
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x28], 0
sete cl
jmp dword [ecx*4 + 0x31239c4]
mov esi, dword [eax + 0xc]
add esi, 0xc
mov dword [esp + 4], 0
mov edx, dword [esi]
xor ecx, ecx
cmp edx, esi
setne cl
mov dword [esp + 0x10], esi
jmp dword [ecx*4 + 0x31239cc]
jmp dword [edi*4 + 0x31239e4]
mov ebx, dword [edx + 0x30]
xor eax, eax
test ebx, ebx
setne al
mov edi, 1
jmp dword [eax*4 + 0x31239d4]
mov ebp, dword [esp + 0x28]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [ebp]
lea ecx, [esi - 0x41]
cmp cx, 0x1a
jae 0x3117c90
or esi, 0x20
movzx ecx, word [ebx]
lea eax, [ecx - 0x41]
cmp ax, 0x1a
jae 0x3117c9f
or ecx, 0x20
test si, si
je 0x3117caf
add ebx, 2
add ebp, 2
cmp si, cx
je 0x3117c80
movzx eax, si
movzx ecx, cx
mov esi, ecx
not esi
and esi, eax
add esi, esi
xor ecx, eax
xor eax, eax
cmp esi, ecx
sete al
mov esi, dword [esp + 0x10]
jmp dword [eax*4 + 0x31239dc]
mov eax, dword [eax + 8]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x3118238
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x3c]
movzx esi, word [edi]
mov dword [esp + 4], 0x93922b25
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x3118176
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0311a270
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x3118150
xor eax, eax
cmp dword [esp + 4], esi
setne al
xor esi, esi
jmp dword [eax*4 + 0x3123ab4]
jmp dword [0x3123abc]
mov dword [esp + 4], 0x13124c40
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja case.0x3118181.2
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0311a300
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x31181b0
jmp case.0x3118181.2
jmp dword [0x3123ac4]
mov ebx, dword [edi + 0x3c]
mov ebp, dword [edi + ebx]
mov dword [esp + 4], 0x13124c40
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x31181e0
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0311a300
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x3118210
jmp 0x31181e0
xor eax, eax
cmp ebp, dword [esp + 4]
setne al
jmp dword [eax*4 + 0x3123acc]
mov ebp, dword [edi + ebx + 0x78]
mov edx, dword [edi + ebx + 0x7c]
test edx, edx
sete al
test ebp, ebp
sete cl
or cl, al
movzx eax, cl
jmp dword [eax*4 + 0x3123ad4]
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10010670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x1008f880]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0xd1d17e6d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
sub eax, 0xd1d17e6d
je 0x100106c2
jmp 0x100106aa
mov eax, dword [ebp - 0x20]
sub eax, 0x71dcea97
je 0x100106d4
jmp 0x100106bd
jmp 0x1001071b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0x71dcea97
jmp 0x1001071b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
not byte [edi]
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
add byte [edi], 0x72
sub byte [edi], 0x25
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
imul byte [edi]
inc edi
loop 0x100106ea
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1002be30
add esp, 0x1c
pop edi
pop ebp
ret
jmp 0x10010694
Function at 0x10030e4a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10030e89
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10030e89
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10030e89
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10030e89
cmp dword [ecx + 0x74], 0xe
jbe 0x10030e89
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10033814
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100338b1
push ebx
push esi
call fcn.100337dd
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10033771
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1003385e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100338b0
push edi
push eax
call fcn.10032112
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1003387e
call fcn.10032160
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100338af
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10033771
add esp, 0x20
test eax, eax
jne 0x1003389d
push edi
call fcn.10032160
jmp 0x100338a5
push ebx
call fcn.10032160
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10033b1e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003ca20
push 0x1003ca18
push str.FlsAlloc
push 0x1f
call fcn.10033a3a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10033b52
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003a150]
call esi
jmp 0x10033b58
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10033b9c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003ca30
push 0x1003ca28
push str.FlsGetValue
push 0x21
call fcn.10033a3a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10033bd3
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003a150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10033bdb
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003ca38
push 0x1003ca30
push str.FlsSetValue
push 0x22
call fcn.10033a3a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10033c15
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1003a150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10039120
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003914d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003914d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4018d0
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x423568]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push ecx
mov esi, esp
mov dword [ebp - 8], 0
push 1
push 0xa
mov edi, ecx
mov dword [esi], 0
call fcn.0040963a
mov ecx, edi
add esp, 8
add eax, 8
mov dword [esi], eax
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401910
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, esi
call fcn.00401e90
mov ecx, dword [esi]
mov eax, dword [ecx - 8]
lea eax, [eax*2 + 2]
push eax
push edi
push ecx
call fcn.00407920
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.00401680
mov esi, dword [ebp - 8]
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0x3e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test esi, esi
je 0x40196e
add esi, 0xfffffff8
push esi
call fcn.00409bf0
add esp, 4
push ecx
mov esi, esp
push 1
push 0xa
mov dword [esi], 0
call fcn.0040963a
mov ecx, edi
add esp, 8
add eax, 8
mov dword [esi], eax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401990
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, esi
call fcn.00401e90
mov ecx, dword [esi]
mov eax, dword [ecx - 8]
lea eax, [eax*2 + 2]
push eax
push edi
push ecx
call fcn.00407920
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.00401680
add esp, 4
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 8]
mov esi, eax
test ecx, ecx
je 0x4019e6
add ecx, 0xfffffff8
push ecx
call fcn.00409bf0
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004065fa
mov esp, ebp
pop ebp
ret
Function at 0x401a00
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x423568]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push ecx
mov esi, esp
mov dword [ebp - 8], 0
push 1
push 0xa
mov edi, ecx
mov dword [esi], 0
call fcn.0040963a
mov ecx, edi
add esp, 8
add eax, 8
mov dword [esi], eax
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401a40
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, esi
call fcn.00401e90
mov ecx, dword [esi]
mov eax, dword [ecx - 8]
lea eax, [eax*2 + 2]
push eax
push edi
push ecx
call fcn.00407920
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.00401680
mov esi, dword [ebp - 8]
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0x3e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test esi, esi
je 0x401a9e
add esi, 0xfffffff8
push esi
call fcn.00409bf0
add esp, 4
push ecx
mov esi, esp
push 1
push 0xa
mov dword [esi], 0
call fcn.0040963a
mov ecx, edi
add esp, 8
add eax, 8
mov dword [esi], eax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401ac0
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, esi
call fcn.00401e90
mov ecx, dword [esi]
mov eax, dword [ecx - 8]
lea eax, [eax*2 + 2]
push eax
push edi
push ecx
call fcn.00407920
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.00401680
add esp, 4
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 8]
mov esi, eax
test ecx, ecx
je 0x401b16
add ecx, 0xfffffff8
push ecx
call fcn.00409bf0
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004065fa
mov esp, ebp
pop ebp
ret