joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401100
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x680
mov dword [ebp - 0x674], edx
mov dword [ebp - 0x670], 0
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcslen]
mov ebx, eax
mov eax, dword [ebp - 0x674]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcslen]
add ebx, eax
mov eax, dword [ebp - 0x670]
mov esi, dword [eax*4 + 0x40408c]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcslen]
lea eax, [ebx + eax + 2]
cmp eax, 0x104
ja 0x401288
lea eax, [ebp - 0x66c]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscpy]
lea eax, [ebp - 0x66c]
mov ebx, dword [sym.imp.ucrtbase.dll_wcscat]
mov dword [esp + 4], 0x404014
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x674]
mov dword [esp + 4], eax
lea eax, [ebp - 0x66c]
mov dword [esp], eax
call ebx
lea eax, [ebp - 0x66c]
mov dword [esp + 4], esi
mov dword [esp], eax
call ebx
lea eax, [ebp - 0x25c]
mov dword [esp + 0x14], 0
mov dword [esp + 8], eax
lea eax, [ebp - 0x66c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindFirstFileExW]
sub esp, 0x18
mov ebx, eax
cmp eax, 0xffffffff
jne 0x401210
add dword [ebp - 0x670], 1
mov eax, dword [ebp - 0x670]
cmp eax, 5
jne 0x40111e
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esi, [ebp - 0x464]
lea esi, [esi]
lea esi, [esi]
lea eax, [ebp - 0x230]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], esi
call dword [sym.imp.shlwapi.dll_PathCombineW]
sub esp, 0xc
test eax, eax
je 0x401258
mov dword [esp + 4], esi
mov dword [esp], str._ls_n
call fcn.00401000
mov dword [section..bss], 1
lea eax, [ebp - 0x25c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindNextFileW]
sub esp, 8
test eax, eax
jne 0x401220
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
jmp 0x4011f2
test byte [section..data], 2
je 0x401208
mov dword [esp + 0xc], str.Path_too_long_n
mov dword [esp + 8], str.search
mov dword [esp + 4], 0x402000
mov dword [esp], 1
call fcn.004010b0
jmp 0x401208
Function at 0x4012c0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x224
mov ecx, dword [ebp + 8]
test ecx, ecx
jle 0x401310
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
xor eax, eax
jmp 0x4012e7
add eax, 1
cmp ebx, eax
je 0x401360
mov edx, dword [ecx + eax*4]
cmp word [edx], 0x2f
jne 0x4012e0
mov ebx, 1
test byte [section..data], 1
jne 0x401460
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [section..bss]
xor ebx, ebx
test eax, eax
jne 0x401302
mov dword [esp], 2
mov ebx, 1
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], 0xf
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.File_not_found_n
call sub.ucrtbase.dll_fwrite
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [ebp + 8], 1
jle 0x401310
mov edi, 1
jmp 0x401378
add edi, 1
cmp dword [ebp + 8], edi
je 0x401310
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + edi*4]
mov dword [esp + 4], 0x3a
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcsrchr]
test eax, eax
je 0x401400
xor edx, edx
lea ebx, [eax + 2]
mov word [eax], dx
mov dword [esp + 4], str.__r_n
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcspbrk]
test eax, eax
jne 0x401370
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov esi, dword [sym.imp.ucrtbase.dll_wcstok]
mov dword [ebp - 0x218], eax
jmp 0x4013d7
mov edx, ebx
call fcn.00401100
lea eax, [ebp - 0x218]
mov dword [esp + 4], 0x404044
mov dword [esp + 8], eax
mov dword [esp], 0
call esi
test eax, eax
jne 0x4013d0
jmp 0x401370
mov dword [esp], str.PATH
call dword [sym.imp.ucrtbase.dll__wgetenv]
mov dword [esp + 4], str.__r_n
mov dword [ebp - 0x21c], eax
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcspbrk]
test eax, eax
jne 0x401370
lea ebx, [ebp - 0x214]
mov dword [esp], 0x104
mov dword [esp + 4], ebx
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
sub esp, 8
test eax, eax
jne 0x401492
mov ebx, esi
mov esi, dword [ebp - 0x21c]
jmp 0x4013b0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.Unsupported_option__ls_n
mov dword [esp + 8], str.wmain
mov dword [esp + 4], 0x402000
mov dword [esp], 0
call fcn.004010b0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, esi
mov eax, ebx
call fcn.00401100
jmp 0x40144a
Function at 0x401e10
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call 0x401e80
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.004012c0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
jmp dword [sym.imp.ucrtbase.dll___p___argc]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401964
Capabilities:
Allocate or change rwx memory
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
cmp dword [ebp + 0xc], 0
jne 0x401986
mov dword [esp], str.ERROR:_no_output_buffer_specified
call sym._puts
mov eax, 0xffffffff
jmp 0x401b67
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call sym._CreateFileA_28
sub esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4019f9
call sym._GetLastError_0
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], str.Couldnt_open_shellcode_containing_file__s:__08x_n
call sym._printf
mov eax, 0xffffffff
jmp 0x401b67
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
cmp eax, 0xffffffff
jne 0x401a36
mov dword [esp], str.Couldnt_get_file_size
call sym._puts
mov eax, 0xffffffff
jmp 0x401b67
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
cmp edx, eax
jbe 0x401a5c
mov dword [esp], str.Execution_offset_larger_than_file_size_
call sym._puts
mov eax, 0xffffffff
jmp 0x401b67
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
test eax, eax
je 0x401a78
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
lea edx, [eax - 0x10000]
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
lea edx, [eax + 0x10000]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._VirtualAlloc_16
sub esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x401ad2
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov dword [esp + 4], eax
mov dword [esp], str.Couldnt_allocate__d_bytes_n
call sym._printf
mov eax, 0xffffffff
jmp 0x401b67
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x10]
lea ecx, [edx + 0x10000]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x401b29
mov dword [esp], str.Couldnt_read_file_bytes
call sym._puts
mov eax, 0xffffffff
jmp 0x401b67
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 0x14]
cmp edx, eax
je 0x401b5a
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str.Only_read__d_of__d_bytes__n
call sym._printf
mov eax, 0xffffffff
jmp 0x401b67
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, 0
leave
ret
Function at 0x402c90
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x409044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40903c]
sub esp, 4
test ebx, ebx
je 0x402cdb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402cd4
test esi, esi
je 0x402cd4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402cb0
mov dword [esp], 0x409044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402ec0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402f10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402fe4
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x402f4e
cmp eax, 4
jne 0x402f70
test esi, esi
je 0x402f62
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x402f54
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x402faf
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x402fa1
cmp ecx, 0x40
je 0x402f62
cmp ecx, 4
je 0x402f62
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402ec0
lea esi, [esi]
Function at 0x10001af0
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x10029494]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x808]
push eax
push 0
push 0
push 0x1001e24c
mov dword [ebp - 0x808], 0
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
je 0x10001b4c
push str.EHNULL
push 0x400
push 0x1002cac8
call fcn.1000bb31
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000bb22
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x808]
push esi
push ecx
lea edx, [ebp - 0x804]
push 0x400
push edx
call fcn.1000bb31
lea eax, [ebp - 0x804]
push eax
push 0x400
push 0x1002cac8
call fcn.1000bb31
mov ecx, dword [ebp - 0x808]
add esp, 0x18
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push str.PerfsLog
push 0x400
push 0x1002cac8
call fcn.1000c903
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0xc
push 0x1002cac8
call esi
cmp eax, 0xffffffff
je 0x10001bb8
test al, 0x10
jne 0x10001c05
push 0
push 0x1002cac8
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10001bef
push str.EHNULL
push 0x400
push 0x1002cac8
call fcn.1000bb31
add esp, 0xc
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000bb22
mov esp, ebp
pop ebp
ret
push 0x1002cac8
call esi
or eax, 2
push eax
push 0x1002cac8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000bb22
mov esp, ebp
pop ebp
ret

Function at 0x10001c20
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
mov ecx, str.EHNULL
mov eax, 0x1002cac8
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10001c56
test dx, dx
je 0x10001c52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10001c56
add eax, 4
add ecx, 4
test dx, dx
jne 0x10001c30
xor eax, eax
jmp 0x10001c5b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10001c77
push str.EHNULL
push 0x400
push 0x1002d2c8
call fcn.1000bb31
add esp, 0xc
ret
push esi
push 0x1002cac8
push 0x400
push 0x1002d2c8
call fcn.1000bb31
push str.Sys
push 0x400
push 0x1002d2c8
call fcn.1000c903
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x18
push 0x1002d2c8
call esi
cmp eax, 0xffffffff
je 0x10001cb9
test al, 0x10
jne 0x10001cf9
push 0
push 0x1002d2c8
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10001ce3
push str.EHNULL
push 0x400
push 0x1002d2c8
call fcn.1000bb31
add esp, 0xc
pop esi
ret
push 0x1002d2c8
call esi
or eax, 2
push eax
push 0x1002d2c8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret
Function at 0x10001d00
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
mov ecx, str.EHNULL
mov eax, 0x1002cac8
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10001d36
test dx, dx
je 0x10001d32
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10001d36
add eax, 4
add ecx, 4
test dx, dx
jne 0x10001d10
xor eax, eax
jmp 0x10001d3b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10001d57
push str.EHNULL
push 0x400
push 0x1002dac8
call fcn.1000bb31
add esp, 0xc
ret
push esi
push 0x1002cac8
push 0x400
push 0x1002dac8
call fcn.1000bb31
push str.Log
push 0x400
push 0x1002dac8
call fcn.1000c903
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x18
push 0x1002dac8
call esi
cmp eax, 0xffffffff
je 0x10001d99
test al, 0x10
jne 0x10001dd9
push 0
push 0x1002dac8
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10001dc3
push str.EHNULL
push 0x400
push 0x1002dac8
call fcn.1000bb31
add esp, 0xc
pop esi
ret
push 0x1002dac8
call esi
or eax, 2
push eax
push 0x1002dac8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret

Function at 0x10001de0
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
mov ecx, str.EHNULL
mov eax, 0x1002cac8
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10001e16
test dx, dx
je 0x10001e12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10001e16
add eax, 4
add ecx, 4
test dx, dx
jne 0x10001df0
xor eax, eax
jmp 0x10001e1b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10001e37
push str.EHNULL
push 0x400
push 0x1002e2c8
call fcn.1000bb31
add esp, 0xc
ret
push esi
push 0x1002cac8
push 0x400
push 0x1002e2c8
call fcn.1000bb31
push str.WinLog
push 0x400
push 0x1002e2c8
call fcn.1000c903
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x18
push 0x1002e2c8
call esi
cmp eax, 0xffffffff
je 0x10001e79
test al, 0x10
jne 0x10001eb9
push 0
push 0x1002e2c8
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10001ea3
push str.EHNULL
push 0x400
push 0x1002e2c8
call fcn.1000bb31
add esp, 0xc
pop esi
ret
push 0x1002e2c8
call esi
or eax, 2
push eax
push 0x1002e2c8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret
Function at 0x10001ec0
Capabilities:
Check if file exists
Create directory
Get file attributes
Set file attributes

Disassembly:
mov ecx, str.EHNULL
mov eax, 0x1002cac8
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10001ef6
test dx, dx
je 0x10001ef2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10001ef6
add eax, 4
add ecx, 4
test dx, dx
jne 0x10001ed0
xor eax, eax
jmp 0x10001efb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10001f17
push str.EHNULL
push 0x400
push 0x1002eac8
call fcn.1000bb31
add esp, 0xc
ret
push esi
push 0x1002cac8
push 0x400
push 0x1002eac8
call fcn.1000bb31
push str.WinRm
push 0x400
push 0x1002eac8
call fcn.1000c903
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x18
push 0x1002eac8
call esi
cmp eax, 0xffffffff
je 0x10001f59
test al, 0x10
jne 0x10001f99
push 0
push 0x1002eac8
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10001f83
push str.EHNULL
push 0x400
push 0x1002eac8
call fcn.1000bb31
add esp, 0xc
pop esi
ret
push 0x1002eac8
call esi
or eax, 2
push eax
push 0x1002eac8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret

Function at 0x10002200
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x808
mov eax, dword [0x10029494]
xor eax, esp
mov dword [esp + 0x804], eax
mov ecx, str.EHNULL
mov eax, 0x1002dac8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000224a
test dx, dx
je 0x10002246
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000224a
add eax, 4
add ecx, 4
test dx, dx
jne 0x10002224
xor eax, eax
jmp 0x1000224f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1000227c
push str.EHNULL
push 0x400
push 0x1002c2c8
call fcn.1000bb31
add esp, 0xc
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.1000bb22
mov esp, ebp
pop ebp
ret
lea eax, [esp]
push eax
call fcn.10001fa0
push 0x1002dac8
push 0x400
push 0x1002c2c8
call fcn.1000bb31
add esp, 0xc
lea ecx, [esp]
push ecx
push 0x400
push 0x1002c2c8
call fcn.1000c903
add esp, 0xc
mov edx, 0x1002c2c8
call fcn.10001730
test al, al
je 0x100022cb
push 0x1002c2c8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.1000bb22
mov esp, ebp
pop ebp
ret
Function at 0x10003d30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001d5e8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10029494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebx + 0x44], 0
je 0x10003ec1
cmp byte [ebx + 0x49], 0
je 0x10003ec1
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, ebx
call edx
cmp eax, 0xffffffff
je 0x10003eb5
lea esi, [ebp - 0x2c]
call fcn.100037c0
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x10003da3
lea edx, [ebp - 0x2c]
mov eax, edx
mov ecx, dword [ebx + 0x44]
mov esi, dword [ecx]
lea edi, [ebp - 0x30]
push edi
mov edi, dword [ebp - 0x1c]
add edi, edx
push edi
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x10003ddc
dec eax
je 0x10003de0
sub eax, 2
lea ecx, [ebp - 0x2c]
je 0x10003ebc
call fcn.10002360
xor al, al
jmp 0x10003ec3
mov byte [ebx + 0x49], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x10003df0
lea edx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, edx
je 0x10003e1d
cmp edi, 0x10
jae 0x10003dff
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x54]
push ecx
push esi
push 1
push eax
call fcn.1000d05b
add esp, 0x10
cmp esi, eax
jne 0x10003ead
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [ebx + 0x49], 0
je 0x10003eb9
test esi, esi
jne 0x10003d97
mov ecx, dword [ebp - 0x1c]
or edx, 0xffffffff
sub edx, ecx
cmp edx, 8
jbe 0x10003ede
lea esi, [ecx + 8]
cmp esi, 0xfffffffe
ja 0x10003ede
cmp edi, esi
jae 0x10003e96
push ecx
push esi
lea ecx, [ebp - 0x2c]
call fcn.10004560
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
test esi, esi
je 0x10003d97
mov ecx, eax
cmp edi, 0x10
jae 0x10003e72
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
jae 0x10003e8d
lea eax, [ebp - 0x2c]
mov byte [eax + esi], 0
jmp 0x10003d91
test esi, esi
jne 0x10003e68
mov dword [ebp - 0x1c], esi
cmp edi, 0x10
jae 0x10003ea5
lea eax, [ebp - 0x2c]
mov byte [eax], 0
jmp 0x10003d91
lea ecx, [ebp - 0x2c]
call fcn.10002360
xor al, al
jmp 0x10003ec3
lea ecx, [ebp - 0x2c]
call fcn.10002360
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000bb22
mov esp, ebp
pop ebp
ret
push str.string_too_long
call fcn.1000b8a5
int3
Function at 0x10004230
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001d58b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10029494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1000b960
push 4
mov dword [ebp - 4], 0
call fcn.1000c187
mov edi, eax
add esp, 4
test edi, edi
je 0x100042ac
call fcn.1000b254
mov dword [edi], eax
call fcn.1000b013
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.1000af48
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x100042a2
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.1000af70
jmp 0x100042ae
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10004df0
Capabilities:
Initialize winhttp library
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x10029494]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.1000aa60
push 0
push 0
push 0
push 0
push str.EH_TEST_FOR_NETWORK_CONNECTION
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
push edi
mov esi, eax
lea eax, [ebp - 0x808]
push 0x400
push eax
call fcn.1000bb31
add esp, 0xc
test esi, esi
je 0x10004eab
push 0
push 0x50
lea ecx, [ebp - 0x808]
push ecx
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov ebx, eax
test ebx, ebx
je 0x10004eab
push 0
push 0
push 0
push 0
push str._TESTCONNECTION
push 0x100214c4
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov edi, eax
test edi, edi
je 0x10004eab
push 0
push 0
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x10004eab
push edi
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call edi
push ebx
call edi
push esi
call edi
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000bb22
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.1000bb22
mov esp, ebp
pop ebp
ret