joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1608ca61
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [edi + ecx*4 + 0x458d8d19]
test al, 0x50
call fcn.1608c77a
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.1608c72f
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1608ca58
invalid
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
or al, 0x88
pop ebp
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.1608c76a
or ebx, dword [ecx]
dec ebx
jnp 0x1608ca3a
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x1608cad5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
call 0xff66532b
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.1608c77a
push eax
push esi
push dword [ebp + 8]
call fcn.1608c72f
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1608c77a
push eax
push esi
push dword [ebp + 8]
call fcn.1608c72f

Function at 0x1608cb80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1608c77a
push eax
push esi
push dword [ebp + 8]
call fcn.1608c72f
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1608c76a
mov byte [edi - 0x62777a8d], dl
jl 0x1608cbef
invalid
invalid
Function at 0x1608cdc7
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x1608ce1e
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1608ce19
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1608ce03
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1608ce0b
cmp edx, ebx
jne 0x1608cf59
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1608cdda
add eax, dword [eax + 4]
jmp fcn.1608cdc7
mov dword [ebp + 0xc], ebx
jmp 0x1608ce29
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1608ce41
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1608ce5f
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1608cebd
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1608cea4
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1608cead
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1608ceb7
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1608ce99
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1608ce23
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x1608eec0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x1608eed9
or eax, 0xffffffff
jmp 0x1608ef3a
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x1608ef36
push 0x3d
push esi
call fcn.1608f0c0
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x1608ef36
cmp esi, eax
je 0x1608ef36
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x16093e88]
sete cl
cmp eax, dword [0x16093e8c]
mov dword [ebp - 8], ecx
jne 0x1608ef1c
mov edi, eax
call fcn.1608ee5f
mov dword [0x16093e88], eax
cmp eax, ebx
jne 0x1608ef75
cmp dword [ebp + 0xc], ebx
je 0x1608ef3e
cmp dword [0x16093e90], ebx
je 0x1608ef3e
call fcn.1608e9e2
test eax, eax
je 0x1608ef75
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x1608ef47
xor eax, eax
jmp 0x1608ef39
push 4
call fcn.16083d3b
cmp eax, ebx
pop ecx
mov dword [0x16093e88], eax
je 0x1608ef36
mov dword [eax], ebx
cmp dword [0x16093e90], ebx
jne 0x1608ef75
push 4
call fcn.16083d3b
cmp eax, ebx
pop ecx
mov dword [0x16093e90], eax
je 0x1608ef36
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x16093e88]
call fcn.1608ee12
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x1608efd6
cmp dword [esi], ebx
je 0x1608efd6
lea esi, [esi + edi*4]
push dword [esi]
call fcn.16083273
cmp dword [ebp - 8], ebx
pop ecx
jne 0x1608efb9
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x1608f017
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x1608efb0
mov eax, edi
shl eax, 2
push eax
push dword [0x16093e88]
call fcn.16083990
cmp eax, ebx
pop ecx
pop ecx
je 0x1608f017
jmp 0x1608f012
cmp dword [ebp - 8], ebx
jne 0x1608f082
cmp edi, ebx
jge 0x1608efe5
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x16093e88]
call fcn.16083990
cmp eax, ebx
pop ecx
pop ecx
je 0x1608ef36
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x16093e88], eax
cmp dword [ebp + 0xc], ebx
je 0x1608f06c
push dword [ebp - 4]
call fcn.16088f30
inc eax
inc eax
push eax
call fcn.16083d3b
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x1608f06c
push dword [ebp - 4]
push esi
call fcn.16088d00
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x1608f065
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.16083273
pop ecx
cmp dword [ebp - 8], ebx
je 0x1608f07a
push dword [ebp - 4]
call fcn.16083273
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x1608ef39
push dword [ebp - 4]
call fcn.16083273
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x1608ef43
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x1ba31949
nop
nop
nop
nop
test eax, eax
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x1f20220b
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x484cfd
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x484a08
and ecx, ecx
sub eax, 0xba9ae8ab
call fcn.00484d30
and eax, eax
mov eax, eax
xor dword [esi], edi
or ecx, eax
add esi, 2
and ecx, ecx
sub ecx, 1
cmp esi, edx
jl fcn.00484cfd
or ecx, eax
or eax, ecx
ret
Function at 0x40db12
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x68d008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0xc]
xorps xmm0, xmm0
push eax
mov esi, ecx
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esi + 0x10]
add eax, 0x4c
pop esi
cmp dword [eax + 0x14], 8
jb 0x40db46
mov eax, dword [eax]
push 8
lea ecx, [ebp - 0xc]
push ecx
push 3
push eax
push str.SoftwareMicrosoftOneDrive
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004192c5
leave
ret
Function at 0x410b29
Capabilities:
Copy file

Disassembly:
push 0x68
mov eax, 0x5f5155
call fcn.004e1c06
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x40]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push esi
call fcn.0040ada4
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.0045e939
push edi
lea ecx, [ebp - 0x28]
call fcn.0040ada4
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.0045e939
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x410b72
mov eax, dword [edi]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.0045e9de
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x410b8e
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x410b98
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.0045e9de
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x410bae
mov eax, dword [eax]
push dword [ebp - 0x44]
push eax
push ecx
call 0x40c97c
lea ecx, [ebp - 0x5c]
call fcn.00405a95
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 1
call fcn.00405a95
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x410bd6
mov ecx, dword [edi]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x410be0
mov eax, dword [esi]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x410c35
cmp dword [edi + 0x14], 8
jb 0x410bf5
mov edi, dword [edi]
push edi
lea eax, [ebp - 0x5c]
push eax
call fcn.0045e9de
mov edi, eax
mov byte [ebp - 4], 4
cmp dword [edi + 0x14], 8
jb 0x410c0d
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x410c15
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x74]
push eax
call fcn.0045e9de
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
jb 0x410c2b
mov eax, dword [eax]
push edi
push eax
push ecx
call 0x40ca38
jmp 0x410c90
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp dword [edi + 0x14], 8
jb 0x410c51
mov edi, dword [edi]
push edi
lea eax, [ebp - 0x5c]
push eax
call fcn.0045e9de
mov edi, eax
mov byte [ebp - 4], 6
cmp dword [edi + 0x14], 8
jb 0x410c69
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x410c71
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x74]
push eax
call fcn.0045e9de
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 8
jb 0x410c87
mov eax, dword [eax]
push ebx
push edi
push eax
push ecx
call 0x40caf4
lea ecx, [ebp - 0x74]
call fcn.00405a95
lea ecx, [ebp - 0x5c]
call fcn.00405a95
lea ecx, [ebp - 0x28]
call fcn.00405a95
lea ecx, [ebp - 0x40]
call fcn.00405a95
mov eax, ebx
call fcn.004e1bb5
ret 8

Function at 0x419d31
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x419d70
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x419d70
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x419d70
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x419d70
cmp dword [ecx + 0x74], 0xe
jbe 0x419d70
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x42c3a3
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x68d008]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x42c3ee
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0042c5c4
test al, al
jne 0x42c3e8
sub edx, 2
cmp edx, edi
jne 0x42c3ce
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x42c410
lea eax, [edi + 2]
cmp edx, eax
je 0x42c410
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0042c2ef
add esp, 0x10
jmp 0x42c50a
push esi
lea ecx, [ebp - 0x255]
call fcn.0042c5c4
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42c453
push dword [ebp - 0x25c]
jmp 0x42c400
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x42c490
cmp word [ebp - 0x226], 0
je 0x42c4b1
cmp word [ebp - 0x226], ax
jne 0x42c490
cmp word [ebp - 0x224], 0
je 0x42c4b1
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0042c2ef
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x42c4fd
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x42c46a
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x42c4e5
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x42c50a
push 0x42c050
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00433910
add esp, 0x10
jmp 0x42c4da
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004192c5
leave
ret

Function at 0x42d337
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x42d348
pop esi
ret
push ebx
push edi
push esi
call fcn.0042d300
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0042bdba
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x42d370
push ebx
push esi
push edi
call fcn.0041a5d0
add esp, 0xc
push 0
call fcn.0042b742
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x42d734
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042d385
Function at 0x42dbb4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x61e078
push 0x61e070
push str.FlsAlloc
push 0x1e
call fcn.0042d9e1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42dbe8
push dword [ebp + 8]
mov ecx, esi
call dword [0x6147a0]
call esi
jmp 0x42dbee
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42dc32
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x61e088
push 0x61e080
push str.FlsGetValue
push 0x20
call fcn.0042d9e1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42dc69
push dword [ebp + 8]
mov ecx, esi
call dword [0x6147a0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x437f8f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x6a4370]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x437fcf
cmp byte [ebx], 0xa
jne 0x437fcf
or byte [eax + edi + 0x28], 4
jmp 0x437fd4
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4380d2
mov al, byte [edx]
cmp al, 0x1a
je 0x4380b4
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x438003
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x438028
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x438032
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x437fe5
jmp 0x4380d2
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4380af
cmp dword [ebp - 0xc], 0
je 0x4380af
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x6a4370]
test byte [eax + edi + 0x28], 0x48
je 0x438089
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x438074
mov byte [esi], dl
jmp 0x438085
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x6a4370]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4380d2
cmp byte [ebp - 1], 0xa
jne 0x438098
cmp esi, ebx
jne 0x438098
mov byte [esi], 0xa
jmp 0x4380d1
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00437eff
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4380d2
mov byte [esi], 0xd
jmp 0x4380d1
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x6a4370]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4380ce
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4380d2
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4380db
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x6a4370]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43811e
cmp word [esi], dx
jne 0x43811e
or byte [edi + eax + 0x28], 4
jmp 0x438123
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x438276
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x438256
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x438165
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x43819b
cmp eax, edx
jae 0x4381a7
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x43813d
jmp 0x438276
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x438252
cmp dword [ebp - 0x14], 0
je 0x438252
mov eax, dword [ebx*4 + 0x6a4370]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x43822a
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4381f3
mov word [esi], cx
jmp 0x438226
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x6a4370]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x6a4370]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x6a4370]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x438276
pop ebx
cmp word [ebp - 4], bx
jne 0x43823b
cmp esi, dword [ebp + 0xc]
jne 0x43823b
mov word [esi], bx
jmp 0x438273
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00437eff
add esp, 0x10
cmp word [ebp - 4], bx
je 0x438276
push 0xd
jmp 0x43826f
mov ecx, dword [ebx*4 + 0x6a4370]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x43826d
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x438276
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x43c34c
Capabilities:
Get common file path

Disassembly:
push 0x23c
mov eax, 0x5f610b
call fcn.004e1c06
mov ebx, dword [ebp + 8]
mov eax, 0x6a77c4
mov dword [ebp - 0x238], ebx
push eax
mov dword [ebp - 0x248], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x244], 1
and dword [ebp - 4], 0
cmp dword [0x694f60], 0
jne 0x43c4db
call fcn.004a2b5c
mov edi, eax
mov eax, dword [edi]
mov esi, dword [eax + 0x88]
mov ecx, esi
call dword [0x6147a0]
mov ecx, edi
call esi
push 0x208
mov byte [ebp - 0x239], al
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0041ab50
add esp, 0xc
cmp byte [0x6a77b8], 0
je 0x43c3db
cmp byte [ebp - 0x239], 0
je 0x43c3db
push 0x26
jmp 0x43c3dd
push 0x1c
pop eax
lea ecx, [ebp - 0x218]
push ecx
xor ecx, ecx
push ecx
push ecx
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x43c4db
and dword [ebp - 0x234], 0
xor eax, eax
and dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
mov byte [ebp - 4], 1
cmp byte [0x6a77b8], al
je 0x43c433
cmp byte [ebp - 0x239], al
mov eax, str.Microsoft_OneDrive_setuplogs
jne 0x43c438
mov eax, str.MicrosoftOneDrive_setuplogs
push eax
lea ecx, [ebp - 0x234]
call fcn.0040aaa9
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
push 0
cmovae eax, dword [ebp - 0x234]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.0043c8f0
mov ecx, dword [ebp - 0x220]
mov esi, eax
mov byte [ebp - 4], 0
cmp ecx, 8
jb 0x43c4c6
mov eax, dword [ebp - 0x234]
lea ecx, [ecx*2 + 2]
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x238], eax
cmp ecx, 0x1000
jb 0x43c4bd
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.00405a41
mov ecx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x238]
push ecx
push eax
call fcn.00419529
pop ecx
pop ecx
test esi, esi
js 0x43c4db
lea eax, [ebp - 0x218]
mov ecx, 0x694f50
push eax
call fcn.0040aaa9
push 0x694f50
mov ecx, ebx
call fcn.0040ada4
push 0x6a77c4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
call fcn.004e1bb5
ret 4