joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f09ac
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4f0b7e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea eax, [ebp - 4]
mov ecx, 0x200
xor edx, edx
call fcn.00406584
push 0
movzx eax, byte [ebp + 8]
mov eax, dword [eax*4 + 0x502948]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004064d4
mov ecx, eax
mov edx, esi
mov eax, ebx
call fcn.0047f7f4
test eax, eax
jne 0x4f0b63
xor eax, eax
push ebp
push 0x4f0b58
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [edi + 4]
mov eax, dword [edi]
xor ecx, ecx
call fcn.0048ad4c
xor ebx, ebx
mov esi, dword [ebp - 4]
test esi, esi
je 0x4f0a3d
sub esi, 4
mov esi, dword [esi]
mov dword [ebp - 0x18], esi
cmp byte [ebp + 8], 0
je 0x4f0a6a
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00406ea8
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov dword [ebp - 0x1c], eax
jmp 0x4f0a8c
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00406ea8
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumValueW
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 1
jb 0x4f0b02
sub eax, 0xe9
je 0x4f0aa6
sub eax, 0x19
je 0x4f0b41
jmp 0x4f0afb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4f0abd
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x10000
jl 0x4f0ad0
call fcn.00404b68
jmp 0x4f0b63
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4f0ae7
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406584
jmp 0x4f0a31
call fcn.00404b68
jmp 0x4f0b63
lea ecx, [ebx + 1]
mov edx, dword [edi + 4]
mov eax, dword [edi]
call fcn.0048ad4c
lea eax, [ebp - 4]
call fcn.00406ea8
mov edx, eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x18]
call fcn.00406584
lea ecx, [ebp - 0x30]
mov eax, edi
mov edx, ebx
call fcn.0049be88
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
call fcn.00488ea4
inc ebx
jmp 0x4f0a31
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f0b5f
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f0b85
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406440
ret
Function at 0x4f6560
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4f65e4
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x4f65cc
mov ebx, esi
test ebx, ebx
je 0x4f6592
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.004064d4
push eax
push 1
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x4f6600
call fcn.00406904
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
mov ebx, eax
jmp 0x4f65ce
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f65eb
lea eax, [ebp - 8]
call fcn.00406438
ret

Function at 0x4fa124
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4fa1cc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4fa1e8
push ebx
push 0x4fa1f8
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004069e8
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403540
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4fa1aa
mov eax, dword [0x502e18]
mov eax, dword [eax + 0x1a8]
call fcn.004fa07c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fa1d3
lea eax, [ebp - 4]
call fcn.00406438
ret
Function at 0x4fab6c
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4fad5a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0047f39c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004ad864
test al, al
jne 0x4fabd9
xor eax, eax
push ebp
push 0x4fabcf
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.004add54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4fabd9
push 0
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
mov eax, dword [0x50a158]
call fcn.004064d4
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x4fac08
mov eax, dword [0x502e18]
mov eax, dword [eax + 0x1a4]
call fcn.004fa07c
push 0x80
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_SetFileAttributesW
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x506b50]
push eax
push 0
mov ecx, 0x4fad68
mov edx, 0x4fad6c
xor eax, eax
call fcn.0040a0fc
mov dword [ebp - 8], eax
push 0x4fa23c
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetWindowLongW
mov dword [0x50a184], eax
xor eax, eax
push ebp
push 0x4fad23
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x502e08]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.0047ed70
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x4fad88
call fcn.0040e15c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
call fcn.0047ec50
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00406844
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004fa124
mov dword [ebp - 0xc], eax
call fcn.004fa200
test al, al
jne 0x4fad03
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4face1
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fad2a
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DestroyWindow
ret
Function at 0x4fc094
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4fc34e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x502e08]
mov eax, dword [eax]
mov edx, 0x4fc368
call fcn.0047b9fc
push 5
mov eax, dword [0x502e08]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x4fc315
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.004e0228
lea eax, [ebp - 0x10]
call fcn.0047f214
mov eax, dword [ebp - 0x10]
call fcn.0040dc08
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.0047ed70
mov edx, dword [ebp - 0x14]
mov eax, 0x50a158
call fcn.00406448
call fcn.004fa434
lea ecx, [ebp - 0x18]
mov edx, 0x4fc388
mov eax, dword [0x50a158]
call fcn.0047de54
mov edx, dword [ebp - 0x18]
mov eax, 0x50a15c
call fcn.00406448
lea ecx, [ebp - 0x1c]
mov edx, 0x4fc3a0
mov eax, dword [0x50a158]
call fcn.0047de54
mov edx, dword [ebp - 0x1c]
mov eax, 0x50a160
call fcn.00406448
push 2
push 0
push 1
mov ecx, dword [0x50a158]
mov dl, 1
mov eax, dword [0x4a9e94]
call fcn.004aa1d4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4fc1ec
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x24]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.004aa194
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.004aa16c
cmp dword [ebp - 0xc], 0x67734d49
je 0x4fc1c7
mov cl, 1
xor edx, edx
mov eax, dword [0x50a160]
call fcn.004ab458
jmp 0x4fc1d6
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x50a158]
call fcn.004ab458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fc1f3
mov eax, dword [ebp - 4]
call fcn.00404098
ret
Function at 0x4fc4f8
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4fc63b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
mov ecx, 0x4fc654
mov edx, ebx
call fcn.00406904
mov eax, dword [ebp - 0x25c]
call fcn.004064d4
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4fc615
xor eax, eax
push ebp
push 0x4fc60e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4fc670
lea eax, [ebp - 0x22c]
mov ecx, 5
call fcn.0040de88
test eax, eax
jne 0x4fc5df
test byte [ebp - 0x258], 0x10
jne 0x4fc5df
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.00406630
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406904
mov esi, dword [ebp - 0x258]
test esi, 1
je 0x4fc5d1
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.004064d4
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4fc569
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fc615
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fc642
lea eax, [ebp - 0x260]
mov edx, 2
call fcn.00406440
lea eax, [ebp - 4]
call fcn.00406438
ret
Function at 0x4fc67c
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4fc77c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00406448
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0047e2f8
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x4fc798
call fcn.0040e15c
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00406904
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x4fc71c
test esi, 0x10
jne 0x4fc74c
test esi, 1
je 0x4fc71c
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
call sub.kernel32.dll_SetFileAttributesW
push 1
mov eax, dword [ebp - 8]
call fcn.004064d4
push eax
mov eax, dword [ebp - 0xc]
call fcn.004064d4
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x4fc746
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00406448
jmp 0x4fc759
inc edi
cmp edi, 0xa
je 0x4fc759
inc ebx
cmp ebx, 0x3e8
jne 0x4fc6bd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fc783
lea eax, [ebp - 0x14]
call fcn.00406438
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406440
ret
Function at 0x10001000
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov esi, eax
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x1000101f
pop edi
lea eax, [esi + 1]
pop esi
pop ebx
pop ebp
ret
test ebx, ebx
jbe 0x1000112b
jmp 0x10001030
mov eax, ebx
cmp ebx, 0x15b0
jb 0x1000103f
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
mov dword [ebp + 8], ebx
jl 0x100010ee
mov edx, eax
shr edx, 4
mov ebx, edx
neg ebx
shl ebx, 4
add eax, ebx
jmp 0x10001060
movzx ebx, byte [esi]
add ecx, ebx
movzx ebx, byte [esi + 1]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 2]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 3]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 4]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 5]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 6]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 7]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 8]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 9]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xa]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xb]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xc]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xd]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xe]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xf]
add edi, ecx
add ecx, ebx
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x10001060
mov ebx, dword [ebp + 8]
test eax, eax
je 0x100010ff
movzx edx, byte [esi]
add ecx, edx
inc esi
add edi, ecx
sub eax, 1
jne 0x100010f2
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x10001030
mov eax, edi
pop edi
shl eax, 0x10
pop esi
or eax, ecx
pop ebx
pop ebp
ret

Function at 0x10001140
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test ecx, ecx
jne 0x1000114b
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
pop ebp
jmp fcn.10001160
Function at 0x10001690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [esi + 0x24]
mov dword [ebp - 0xc], edi
jmp 0x100016a3
mov edi, dword [ebp - 0xc]
mov ebx, dword [esi + 0x34]
sub ebx, dword [esi + 0x6c]
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x24]
sub ebx, eax
lea edx, [edi + ecx - 0x106]
mov dword [ebp - 4], ebx
cmp eax, edx
jb 0x10001721
mov eax, dword [esi + 0x30]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.10037db0
mov edx, dword [esi + 0x44]
mov eax, dword [esi + 0x3c]
sub dword [esi + 0x68], edi
sub dword [esi + 0x64], edi
add esp, 0xc
sub dword [esi + 0x54], edi
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x100016f1
sub eax, edi
jmp 0x100016f3
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x100016e2
mov ecx, dword [esi + 0x38]
mov edx, edi
lea ecx, [ecx + edi*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x10001712
sub eax, edi
jmp 0x10001714
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x10001703
add ebx, edi
mov dword [ebp - 4], ebx
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x100017da
mov edx, dword [esi + 0x6c]
add edx, dword [esi + 0x64]
mov eax, dword [edi + 4]
add edx, dword [esi + 0x30]
mov ecx, dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 8], edx
cmp ebx, ecx
jbe 0x10001747
mov ebx, ecx
test ebx, ebx
je 0x1000179c
sub eax, ebx
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x1000176b
mov eax, dword [edi]
mov ecx, dword [edi + 0x30]
push ebx
call fcn.10001000
add esp, 4
jmp 0x10001784
cmp eax, 2
jne 0x1000178a
mov ecx, dword [edi]
mov eax, dword [edi + 0x30]
test ecx, ecx
jne 0x1000177d
xor eax, eax
jmp 0x10001787
mov edx, ebx
call fcn.10001160
mov edx, dword [ebp - 8]
mov dword [edi + 0x30], eax
mov ecx, dword [edi]
push ebx
push ecx
push edx
call fcn.10037db0
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x6c], ebx
mov edi, dword [esi + 0x6c]
cmp edi, 3
jb 0x100017c6
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x64]
mov ecx, dword [esi + 0x50]
add edx, eax
movzx eax, byte [edx]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp edi, 0x106
jae 0x100017da
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x100016a0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005a00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
push edi
push 0x44
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.10036e20
add esp, 0xc
xor eax, eax
xor ecx, ecx
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x5c]
push eax
push ecx
push ecx
push 8
push ecx
push ecx
push ecx
mov word [ebp - 0x2c], cx
mov ecx, dword [ebp + 8]
push ecx
push 0
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x30], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test esi, esi
je 0x10005a7b
mov edx, dword [ebp - 0x14]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [ebp - 0x10]
push ecx
call edi
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10005d80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100faa98
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x1013f030]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
jb 0x10005db5
mov eax, dword [eax + 4]
jmp 0x10005db8
add eax, 4
push 0x101385b8
push eax
call fcn.1003114e
mov edi, eax
add esp, 8
test edi, edi
je 0x10005f0c
lea eax, [ebp - 0x30]
push eax
call fcn.10007d30
push edi
push 1
lea ecx, [ebp + 0xb]
push 1
push ecx
mov dword [ebp - 4], 0
call fcn.10031405
add esp, 0x10
test eax, eax
je 0x10005e50
mov edx, dword [ebp - 0x24]
test edx, edx
jne 0x10005e00
xor ecx, ecx
jmp 0x10005e05
mov ecx, dword [ebp - 0x1c]
sub ecx, edx
mov eax, dword [ebp - 0x20]
mov esi, eax
sub esi, edx
cmp esi, ecx
mov esi, eax
jae 0x10005e1d
mov dl, byte [ebp + 0xb]
inc esi
mov byte [eax], dl
mov dword [ebp - 0x20], esi
jmp 0x10005e3b
cmp edx, eax
jbe 0x10005e26
call fcn.10031672
mov eax, dword [ebp - 0x30]
push esi
push eax
lea eax, [ebp + 0xb]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea eax, [ebp - 0x30]
call fcn.10008050
push edi
push 1
lea edx, [ebp + 0xb]
push 1
push edx
call fcn.10031405
add esp, 0x10
test eax, eax
jne 0x10005df5
push edi
call fcn.10031499
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebx + 0x14]
sub edx, ecx
add esp, 4
cmp edx, eax
ja 0x10005e7d
xor esi, esi
cmp ecx, esi
je 0x10005e77
push ecx
call fcn.10031f94
add esp, 4
mov eax, dword [ebp - 0x30]
push eax
jmp 0x10005efb
mov dword [ebp - 0x14], 0
xor esi, esi
test eax, eax
jbe 0x10005ecf
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
lea edi, [esi + edx]
sub eax, ecx
cmp edi, eax
jb 0x10005ea1
call fcn.10031672
mov ecx, dword [ebp - 0x24]
add edi, ecx
cmp esi, dword [ebx + 0x14]
jbe 0x10005eb0
call fcn.10031672
mov ecx, dword [ebp - 0x24]
cmp dword [ebx + 0x18], 8
jb 0x10005ebb
mov eax, dword [ebx + 4]
jmp 0x10005ebe
lea eax, [ebx + 4]
movzx edx, word [eax + esi*2]
movsx eax, byte [edi]
cmp eax, edx
jne 0x10005ecf
inc esi
cmp esi, dword [ebx + 0x14]
jb 0x10005e8a
mov eax, dword [ebx + 0x14]
cmp esi, eax
je 0x10005f1f
mov esi, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
sub esi, eax
inc edx
sub esi, ecx
mov dword [ebp - 0x14], edx
cmp edx, esi
jbe 0x10005e84
xor esi, esi
cmp ecx, esi
je 0x10005ef7
push ecx
call fcn.10031f94
add esp, 4
mov edx, dword [ebp - 0x30]
push edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
call fcn.10031f94
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor esi, esi
cmp ecx, esi
je 0x10005f2e
push ecx
call fcn.10031f94
add esp, 4
mov ecx, dword [ebp - 0x30]
push ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
call fcn.10031f94
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10006e40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 4]
xor ebx, ebx
push edi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
cmp eax, ebx
je 0x10006e63
push eax
call fcn.10030c8f
add esp, 4
mov dword [esi + 4], ebx
mov eax, dword [ebp + 8]
push 0x101385b8
push eax
call fcn.1003114e
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x10006ec4
push 2
push ebx
push edi
call fcn.1003170c
push edi
call fcn.1003192e
push 0
push 0
push edi
mov ebx, eax
call fcn.1003170c
add esp, 0x1c
test ebx, ebx
je 0x10006ecb
mov eax, ebx
call fcn.10013aa0
push edi
test al, al
je 0x10006ebc
mov esi, dword [esi + 4]
push ebx
push 1
push esi
call fcn.10031405
add esp, 0x10
cmp eax, ebx
je 0x10006ecb
push edi
call fcn.10031499
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret
push edi
call fcn.10031499
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret
Function at 0x1000a470
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x1013f030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
push esi
push edi
mov esi, ecx
jb 0x1000a495
mov eax, dword [eax + 4]
jmp 0x1000a498
add eax, 4
push 0x101385b8
push eax
call fcn.1003114e
mov edi, eax
add esp, 8
mov dword [ebp - 0x208], edi
test edi, edi
jne 0x1000a4c6
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10030c80
mov esp, ebp
pop ebp
ret 4
push ebx
xor eax, eax
call fcn.10013aa0
push edi
push 0x200
lea eax, [ebp - 0x204]
push 1
push eax
call fcn.10031405
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x1000a5a8
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x10]
lea eax, [ecx + ebx + 1]
cmp eax, edx
ja 0x1000a587
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jbe 0x1000a55b
mov edi, ecx
test ecx, ecx
jne 0x1000a513
mov edi, 0xa
cmp dword [esi + 0x14], 1
jne 0x1000a528
cmp edi, eax
ja 0x1000a52a
lea ecx, [ecx]
add edi, edi
cmp edi, eax
jbe 0x1000a520
jmp 0x1000a52a
mov edi, eax
cmp edi, edx
jb 0x1000a530
mov edi, eax
mov eax, dword [esi + 4]
push edi
test eax, eax
je 0x1000a543
push eax
call fcn.10032818
add esp, 8
jmp 0x1000a54b
call fcn.10030d6c
add esp, 4
test eax, eax
je 0x1000a581
mov dword [esi + 0xc], edi
mov edi, dword [ebp - 0x208]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
add eax, dword [esi + 8]
push ebx
lea edx, [ebp - 0x204]
push edx
push eax
call fcn.10037db0
mov ecx, dword [esi + 4]
add esp, 0xc
add dword [esi + 8], ebx
mov eax, dword [esi + 8]
mov byte [eax + ecx], 0
jmp 0x1000a587
mov edi, dword [ebp - 0x208]
push edi
push 0x200
lea edx, [ebp - 0x204]
push 1
push edx
call fcn.10031405
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x1000a4ef
push edi
call fcn.10031499
mov ecx, dword [ebp - 4]
add esp, 4
pop ebx
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.10030c80
mov esp, ebp
pop ebp
ret 4