joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4718a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4bc4d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push ebx
push esi
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
call fcn.00471c90
mov esi, eax
lea edx, [esp + 0x48]
xor ebx, ebx
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], 0x6ed9ac
call fcn.004801b8
mov ecx, dword [0x5c047c]
mov al, byte [esi]
push ecx
push ebx
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x48], 1
mov byte [esp + 0x30], al
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call fcn.0046eff0
mov esi, 0x5c04d4
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0xc]
mov byte [esp + 0x3c], 3
cmp eax, ebx
je 0x471947
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x47193e
cmp al, 0xff
je 0x47193e
dec al
mov byte [ecx], al
jmp 0x471947
push ecx
call fcn.004acb45
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.004a87d0
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3c], 0xffffffff
cmp eax, ebx
mov dword [esp + 0x18], esi
je 0x47198d
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x471984
cmp al, 0xff
je 0x471984
dec al
mov byte [ecx], al
jmp 0x47198d
push ecx
call fcn.004acb45
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.0048023f
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x475e60
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x475ea9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x476320
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bc7b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00475ed0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00475f50
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00475f50
lea ecx, [esi + 0xc]
call fcn.004acd66
lea ecx, [esi + 0x10]
call fcn.004acd66
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004774e0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004774e0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004774e0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004acddb
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004acddb
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4776d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x477736
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x477736
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x477717
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x4a2e70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4bdbf0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.00497b96
mov eax, dword [0x68bc48]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.00497ac8
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.004a3910
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x4a2f17
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4a2f0e
cmp al, 0xff
je 0x4a2f0e
dec al
mov byte [ecx], al
jmp 0x4a2f17
push ecx
call fcn.004acb45
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4a2f48
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4a2f3f
cmp al, 0xff
je 0x4a2f3f
dec al
mov byte [ecx], al
jmp 0x4a2f48
push ecx
call fcn.004acb45
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x4af1a9
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4af1e1
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004ad236
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004ad20e
jmp 0x4af1ed
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4b089e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b08e0
call fcn.004b665d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4b08e0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b08d7
xor eax, eax
jmp 0x4b08e8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b08ee
pop edi
pop esi
pop ebx
ret 4

Function at 0x4b6b8d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4b6bbb
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4b6bd9
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004b6af3
jmp 0x4b6bd9
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4b6bd9
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004b6af3
test edi, edi
mov eax, edi
jne 0x4b6bc3
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10025d7
Capabilities:
Write file on windows

Disassembly:
push 0x82c
push 0x1001178
call fcn.01003794
mov eax, dword [0x1005014]
mov dword [ebp - 0x1c], eax
xor edi, edi
cmp dword [0x1005034], edi
je 0x1002709
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x824], eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x830], eax
sub eax, dword [0x100515c]
mov dword [ebp - 0x83c], eax
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [ebp - 0x828], eax
mov dword [ebp - 0x838], edx
push edx
push eax
push 0x100116c
lea eax, [ebp - 0x81c]
push eax
call dword [sym.imp.ntdll.dll_sprintf]
mov esi, eax
mov dword [ebp - 0x82c], esi
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, 0x7fe
sub eax, esi
push eax
lea eax, [ebp + esi - 0x81c]
push eax
call dword [sym.imp.ntdll.dll__vsnprintf]
add esp, 0x20
mov dword [ebp - 0x820], eax
cmp eax, edi
jge 0x1002689
mov dword [ebp - 0x820], 0x7fd
jmp 0x100268f
add dword [ebp - 0x820], esi
mov eax, dword [ebp - 0x820]
lea eax, [ebp + eax - 0x81c]
cmp byte [eax - 1], 0xa
jne 0x10026b7
cmp byte [eax - 2], 0xd
je 0x10026cf
mov byte [eax - 1], 0xd
mov byte [eax], 0xa
inc dword [ebp - 0x820]
jmp 0x10026cf
mov byte [eax], 0xd
mov eax, dword [ebp - 0x820]
mov byte [ebp + eax - 0x81b], 0xa
add dword [ebp - 0x820], 2
push edi
lea eax, [ebp - 0x834]
push eax
push dword [ebp - 0x820]
lea eax, [ebp - 0x81c]
push eax
push dword [0x1005034]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x10026f9
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x824]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x1c]
call fcn.010036f5
call fcn.010037cf
ret 8
Function at 0x1002728
Capabilities:
Delete file
Set file attributes
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x1005014]
push ebx
push esi
xor esi, esi
cmp dword [0x100515c], esi
mov dword [ebp + 0x19c], eax
push edi
mov dword [ebp - 0x70], esi
jne 0x100275c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100515c], eax
cmp dword [ebp + 0x1a8], esi
je 0x1002781
push 0x80
push dword [ebp + 0x1ac]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp + 0x1ac]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp + 0x1ac]
lea edx, [ebp + 0x98]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x100278f
push esi
mov ebx, 0x80000000
push ebx
push 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, 0xc0000000
jmp 0x10027e2
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 9
ja 0x10028c4
push dword [ebp - 0x70]
lea eax, [ebp + 0x98]
push dword [ebp + 0x1ac]
push 0x10011b8
push eax
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x10
push 0
push ebx
push 4
push 0
push 1
lea eax, [ebp + 0x98]
push edi
push eax
call esi
cmp eax, 0xffffffff
mov dword [0x1005034], eax
je 0x10027b0
xor esi, esi
xor ecx, ecx
mov dl, byte [ebp + ecx + 0x98]
mov byte [ecx + 0x1005038], dl
inc ecx
test dl, dl
jne 0x10027fc
push 2
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x100285f
lea eax, [ebp + 0x98]
push eax
call fcn.010025a8
cmp eax, esi
je 0x100285f
push eax
lea eax, [ebp - 0x6c]
push 0x10011b0
push eax
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
push esi
lea ecx, [ebp + 0x1ac]
push ecx
push eax
mov dword [ebp + 0x1ac], eax
lea eax, [ebp - 0x6c]
push eax
push dword [0x1005034]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x14
pop ecx
mov eax, 0x3d3d3d3d
lea edi, [ebp + 0x98]
rep stosd dword es:[edi], eax
lea eax, [ebp + 0x98]
push eax
mov byte [ebp + 0xe8], 0
call fcn.01002719
pop ecx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x72]
push eax
movzx eax, word [ebp - 0x74]
push eax
movzx eax, word [ebp - 0x76]
push eax
movzx eax, word [ebp - 0x78]
push eax
movzx eax, word [ebp - 0x7a]
push eax
movzx eax, word [ebp - 0x7e]
push eax
movzx eax, word [ebp - 0x80]
push eax
push 0x1001184
call fcn.01002719
mov eax, dword [0x1005034]
add esp, 0x20
jmp 0x10028cd
and dword [0x1005034], 0
xor eax, eax
mov ecx, dword [ebp + 0x19c]
pop edi
pop esi
pop ebx
call fcn.010036f5
add ebp, 0x1a0
leave
ret 8
Function at 0x100297c
Capabilities:
Delete registry value
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x10013a8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edi, eax
xor esi, esi
cmp edi, esi
je 0x10029b1
push edi
push 0x100136c
call fcn.01002719
pop ecx
pop ecx
jmp 0x1002a6f
mov eax, dword [ebp + 8]
sub eax, esi
je 0x1002a3d
dec eax
je 0x1002a21
dec eax
je 0x10029cc
push dword [ebp + 8]
push 0x100133c
jmp 0x1002a15
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
push esi
mov esi, 0x1001318
push esi
push dword [ebp - 4]
mov dword [ebp - 8], 8
mov dword [ebp + 8], 0xb
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x1002a03
push edi
push 0x10012d8
jmp 0x1002a5f
cmp dword [ebp + 8], 0xb
jne 0x1002a0f
cmp dword [ebp - 8], 8
je 0x1002a66
push esi
push 0x10012a8
call fcn.01002719
pop ecx
pop ecx
push 0x57
pop edi
jmp 0x1002a66
push 0x1001318
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
cmp edi, esi
je 0x1002a66
push edi
push 0x1001268
jmp 0x1002a5f
push 8
push dword [ebp + 0xc]
push 0xb
push esi
push 0x1001318
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp edi, esi
je 0x1002a66
push edi
push 0x1001228
call fcn.01002719
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret 8

Function at 0x1002ace
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
lea eax, [ebp - 0xc]
push eax
push 2
call fcn.0100297c
test eax, eax
je 0x1002aeb
push eax
push 0x10015b0
jmp 0x1002b13
push edi
push 0xc
pop ecx
xor eax, eax
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push 0x30
lea eax, [ebp - 0x3c]
push eax
push 3
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
pop edi
je 0x1002b1f
push eax
push 0x1001560
call fcn.01002719
pop ecx
pop ecx
xor eax, eax
inc eax
leave
ret
push dword [ebp - 0x3c]
push dword [ebp - 0x38]
push dword [ebp - 0xc]
push dword [ebp - 8]
push 0x1001510
call fcn.01002719
mov eax, dword [ebp - 8]
add esp, 0x14
cmp eax, dword [ebp - 0x38]
jl 0x1002b1a
jne 0x1002b4a
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x3c]
jbe 0x1002b1a
xor eax, eax
leave
ret
Function at 0x1002b4e
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1005014]
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x210]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1002b89
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x1001840
jmp 0x1002bab
push 2
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, esi
mov dword [ebp - 0x214], eax
jne 0x1002bba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x10017d0
call dword [sym.imp.msvcrt.dll_wprintf]
pop ecx
pop ecx
mov eax, esi
jmp 0x1002c68
push ebx
push edi
push esi
push esi
push 0x10017bc
push esi
push esi
lea ecx, [ebp - 0x210]
push ecx
push 1
push 2
push 0x10
push 0xf01ff
push 0x1001760
push 0x100174c
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
cmp ebx, esi
jne 0x1002c09
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001730
call fcn.01002719
pop ecx
pop ecx
jmp 0x1002c43
mov eax, dword [ebp + 8]
push 0x1001700
mov dword [ebp + 8], eax
call dword [sym.imp.msvcrt.dll_wprintf]
pop ecx
lea eax, [ebp + 8]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1002c40
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001680
call dword [sym.imp.msvcrt.dll_wprintf]
pop ecx
pop ecx
push ebx
call edi
push dword [ebp - 0x214]
call edi
call fcn.01002a77
mov edi, eax
cmp edi, esi
je 0x1002c64
push edi
push 0x10015f8
call dword [sym.imp.msvcrt.dll_wprintf]
pop ecx
pop ecx
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.010036f5
leave
ret 4

Function at 0x1002c75
Capabilities:
Delete service

Disassembly:
push ebp
push esi
push edi
push 2
xor ebp, ebp
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
cmp edi, ebp
jne 0x1002ca4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x1001950
call dword [sym.imp.msvcrt.dll_wprintf]
pop ecx
pop ecx
mov eax, esi
jmp 0x1002d02
push ebx
push 0x10000
push 0x100174c
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
cmp esi, ebp
jne 0x1002cd9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
push ebp
push 0x1001918
call fcn.01002719
pop ecx
pop ecx
jmp 0x1002cfc
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1002cf9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
push ebp
push 0x10018e0
call fcn.01002719
pop ecx
pop ecx
push esi
call ebx
push edi
call ebx
mov eax, ebp
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x1002df8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x1005014]
push ebx
mov ebx, dword [ebp + 0x198]
push esi
push edi
push ebx
push 0x1001bcc
mov dword [ebp + 0x18c], eax
call fcn.01002719
cmp word [ebx], 0x22
mov edi, dword [sym.imp.ntdll.dll_wcsncpy]
pop ecx
pop ecx
jne 0x1002e84
inc ebx
inc ebx
cmp word [ebx], 0x22
je 0x1002e33
push 0x22
push ebx
call dword [sym.imp.ntdll.dll_wcschr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x1002f2d
push 0x20
push ebx
call dword [sym.imp.ntdll.dll_wcschr]
test eax, eax
pop ecx
pop ecx
je 0x1002e80
cmp eax, esi
jae 0x1002e80
sub esi, ebx
sar esi, 1
lea eax, [esi + 2]
push eax
add ebx, 0xfffffffe
lea eax, [ebp - 0x80]
push ebx
push eax
call edi
add esp, 0xc
and word [ebp + esi*2 - 0x7c], 0
jmp 0x1002ebc
sub esi, ebx
jmp 0x1002ea9
lea eax, [ebx + 2]
push 0x20
push eax
call dword [sym.imp.ntdll.dll_wcschr]
test eax, eax
pop ecx
pop ecx
jne 0x1002ea5
lea eax, [ebp - 0x80]
push ebx
push eax
call dword [sym.imp.ntdll.dll_wcscpy]
pop ecx
pop ecx
jmp 0x1002ebc
sub eax, ebx
mov esi, eax
sar esi, 1
push esi
lea eax, [ebp - 0x80]
push ebx
push eax
call edi
add esp, 0xc
and word [ebp + esi*2 - 0x80], 0
lea eax, [ebp - 0x80]
push eax
push 0x1001b94
call fcn.01002719
pop ecx
pop ecx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1002eef
push eax
lea eax, [ebp - 0x80]
push eax
push 0x1001b48
call fcn.01002719
add esp, 0xc
jmp 0x1002f2d
test al, 0x50
je 0x1002efe
lea eax, [ebp - 0x80]
push eax
push 0x1001af8
jmp 0x1002f26
cmp word [ebp - 0x80], 0x22
lea ebx, [ebp - 0x7e]
je 0x1002f0b
lea ebx, [ebp - 0x80]
lea eax, [ebp - 0x80]
push 0x5c
push eax
call dword [sym.imp.ntdll.dll_wcsrchr]
test eax, eax
pop ecx
pop ecx
jne 0x1002f31
lea eax, [ebp - 0x80]
push eax
push 0x1001ab4
call fcn.01002719
pop ecx
pop ecx
xor eax, eax
jmp 0x1002f5c
sub eax, ebx
mov esi, eax
sar esi, 1
push esi
push ebx
mov ebx, dword [ebp + 0x19c]
push ebx
call edi
and word [ebx + esi*2], 0
push ebx
lea eax, [ebp - 0x80]
push eax
push 0x1001a8c
call fcn.01002719
xor eax, eax
add esp, 0x18
inc eax
mov ecx, dword [ebp + 0x18c]
pop edi
pop esi
pop ebx
call fcn.010036f5
add ebp, 0x190
leave
ret 8
Function at 0x1002f74
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x808]
sub esp, 0x888
mov eax, dword [0x1005014]
push ebx
push edi
mov dword [ebp + 0x804], eax
xor eax, eax
push 0x11
pop ecx
push dword [ebp + 0x810]
lea edi, [ebp - 0x80]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp + 0x1e4]
push eax
mov dword [ebp - 0x80], 0x44
call dword [sym.imp.ntdll.dll_wcscpy]
lea eax, [ebp + 0x1e4]
push eax
push 0x1001db8
call fcn.01002719
add esp, 0x10
lea eax, [ebp + 0x5f8]
push eax
xor ebx, ebx
lea eax, [ebp + 0x1e4]
push eax
mov word [ebp + 0x5f8], bx
mov dword [ebp - 0x2c], ebx
mov dword [ebp + 0x810], ebx
call fcn.01002df8
test eax, eax
jne 0x1002fff
push 2
pop eax
jmp 0x1003131
cmp word [ebp + 0x5f8], bx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x1003064
lea eax, [ebp - 0x28]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1003055
lea eax, [ebp + 0x5f8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x100303c
mov dword [ebp - 0x2c], 1
jmp 0x1003064
lea eax, [ebp + 0x5f8]
push eax
call esi
push eax
push 0x1001d58
call fcn.01002719
add esp, 0xc
jmp 0x1003064
call esi
push eax
push 0x1001d24
call fcn.01002719
pop ecx
pop ecx
lea eax, [ebp + 0x1e4]
push eax
push 0x1001cf8
call fcn.01002719
pop ecx
pop ecx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x1e4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10030b0
call esi
lea ecx, [ebp + 0x1e4]
push ecx
push eax
push 0x1001cc4
call fcn.01002719
add esp, 0xc
jmp 0x100310c
push 0x1001c9c
call fcn.01002719
pop ecx
push 0xffffffffffffffff
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 0x810]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x10030fc
cmp dword [ebp + 0x810], ebx
je 0x10030fc
push dword [ebp + 0x810]
lea eax, [ebp + 0x1e4]
push eax
push 0x1001c50
call fcn.01002719
add esp, 0xc
push dword [ebp - 0x3c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x38]
call edi
cmp dword [ebp - 0x2c], ebx
je 0x100312e
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x100312e
call esi
push eax
push 0x1001bf8
call fcn.01002719
pop ecx
pop ecx
xor eax, eax
pop esi
mov ecx, dword [ebp + 0x804]
pop edi
pop ebx
call fcn.010036f5
add ebp, 0x808
leave
ret 4
Function at 0x10033c3
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x1005014]
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1003409
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push 0x1002200
call fcn.01002719
pop ecx
pop ecx
call esi
jmp 0x10034f0
lea eax, [ebp - 0x210]
push 0x2e
push eax
call dword [sym.imp.ntdll.dll_wcsrchr]
test eax, eax
pop ecx
pop ecx
jne 0x100343c
push 0x7b
lea eax, [ebp - 0x210]
push eax
push 0x10021a8
call fcn.01002719
add esp, 0xc
push 0x7b
pop eax
jmp 0x10034f0
push edi
add eax, 2
push 0x10021a0
push eax
call dword [sym.imp.ntdll.dll_wcscpy]
pop ecx
pop ecx
mov esi, 0x1001fd8
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.0100327e
mov edi, eax
test edi, edi
je 0x1003473
push edi
push 0x1002160
call fcn.01002719
pop ecx
pop ecx
push 0x104
lea eax, [ebp - 0x418]
push eax
push esi
call fcn.01003148
test eax, eax
je 0x10034b7
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0100327e
mov edi, eax
test edi, edi
je 0x10034bb
lea eax, [ebp - 0x418]
push eax
push edi
push 0x1002110
call fcn.01002719
add esp, 0xc
test edi, edi
jne 0x10034ed
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10034da
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10020b8
jmp 0x10034e6
lea eax, [ebp - 0x210]
push eax
push 0x1002070
call fcn.01002719
pop ecx
pop ecx
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
call fcn.010036f5
leave
ret

Function at 0x10036f5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1005014]
jne 0x10036fe
ret
jmp 0x1003703
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x1005014]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x1005170]
test eax, eax
je 0x1003727
call eax
cmp dword [0x1005174], 0
je 0x100376e
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x1005174]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.010036f5
add ebp, 0x2a8
leave
ret