joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8aadc0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x84], 0x80c9e4
mov dword [ebp - 0x80], 0x98ac8c
lea edx, [ebp - 0x18]
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x78], 0x8ab1c1
mov dword [ebp - 0x74], esp
lea eax, [ebp - 0x9c]
mov dword [esp], eax
call fcn.0080f6e4
mov dword [ebp - 0x98], 8
call sub.KERNEL32.dll_TlsAlloc
mov edx, dword [ebp - 0xac]
mov dword [edx], eax
cmp eax, 0xffffffff
jne 0x8ab29c
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 0xb0], eax
call fcn.007b0de4
mov edx, dword [ebp - 0xb0]
mov dword [ebp - 0xa8], edx
lea edx, [ebp - 0xa8]
mov dword [edx + 4], eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call fcn.00922308
lea edx, [ebp - 0x58]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x9ad602
lea eax, [ebp - 0x48]
mov dword [esp], eax
mov dword [ebp - 0x98], 7
call fcn.0092bb18
lea edx, [ebp - 0x48]
mov dword [esp + 4], edx
lea eax, [ebp - 0x38]
mov dword [esp], eax
mov dword [ebp - 0x98], 6
call fcn.00810f24
jmp 0x8aaf5b
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xcc], eax
sub eax, 0xc
mov dword [ebp - 0xc8], eax
lea edx, [ebp - 0x48]
mov dword [esp + 4], edx
lea eax, [ebp - 0x68]
mov dword [esp], eax
call fcn.009222f8
cmp dword [ebp - 0xc8], 0x9aba1c
je 0x8aafef
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0xcc]
sub eax, 4
mov dword [esp], eax
mov dword [ebp - 0x98], 4
call fcn.00815de4
test eax, eax
jg 0x8aafef
lea edx, [ebp - 0x68]
mov dword [esp + 4], edx
mov eax, dword [ebp - 0xc8]
mov dword [esp], eax
call fcn.00929958
jmp 0x8aafef
lea eax, [ebp - 0x68]
mov dword [esp], eax
call fcn.00922338
lea eax, [ebp - 0x48]
mov dword [esp], eax
call fcn.00922348
lea eax, [ebp - 0x58]
mov dword [esp], eax
call fcn.00922338
mov dword [ebp - 0x38], 0x9efcb8
mov eax, dword [ebp - 0xa8]
mov edx, dword [ebp - 0xa4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x38]
add eax, 0x10
mov dword [esp], eax
call fcn.0092be78
lea eax, [ebp - 0x38]
mov dword [esp], eax
mov dword [ebp - 0x98], 3
call fcn.0085a120
jmp 0x8ab148
mov dword [ebp - 0x38], 0x9efcb8
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0xe0], edx
sub edx, 0xc
mov dword [ebp - 0xdc], edx
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
lea edx, [ebp - 0x68]
mov dword [esp], edx
call fcn.009222f8
cmp dword [ebp - 0xdc], 0x9aba1c
je 0x8ab21f
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0xe0]
sub eax, 4
mov dword [esp], eax
mov dword [ebp - 0x98], 1
call fcn.00815de4
test eax, eax
jg 0x8ab21f
lea eax, [ebp - 0x68]
mov dword [esp + 4], eax
mov edx, dword [ebp - 0xdc]
mov dword [esp], edx
call fcn.00929958
jmp 0x8ab21f
lea eax, [ebp - 0x68]
mov dword [esp], eax
call fcn.00922338
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.00922348
lea edx, [ebp - 0x38]
mov dword [esp], edx
call fcn.00810d74
jmp 0x8ab29c
lea eax, [ebp - 0x9c]
mov dword [esp], eax
call fcn.0080f7c4
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x8c85e0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov edx, 0x9a8862
mov ebp, esp
push edi
mov eax, 0x8c8776
mov edi, 0x80c9e4
push esi
lea esi, [ebp - 0x18]
push ebx
sub esp, 0xcc
lea ebx, [ebp - 0xbc]
mov dword [ebp - 0xa4], edi
mov ecx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0x9c], esi
mov esi, 0xffffffff
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], esp
mov dword [esp], ebx
call fcn.0080f6e4
mov dword [esp + 4], edi
mov edx, dword [ebp - 0xc0]
xor ecx, ecx
mov dword [esp + 8], ecx
mov eax, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
mov dword [ebp - 0xb8], esi
mov dword [esp], edx
call eax
sub esp, 0xc
cmp eax, 0xc15730e2
je 0x8c8760
cld
mov esi, str.C15730E2_145C_4c5e_B005_3BC753F42475_once_flag
mov ebx, dword [ebp - 0xc0]
movzx edx, byte [0x9f0850]
mov ecx, 0xc
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov esi, 0xffffffff
mov byte [edi], dl
lea edi, [ebp - 0x68]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.008b120c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [ebp - 0x30]
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.008b123c
mov dword [esp + 8], edi
xor edx, edx
mov dword [esp + 4], edx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 0xc
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x88], eax
mov dword [esp], eax
mov eax, 2
mov dword [esp + 4], esi
mov dword [ebp - 0xb8], eax
call ebx
mov ebx, dword [ebp - 0xc0]
sub esp, 8
cmp dword [ebx], 0xc15730e2
je 0x8c872a
mov eax, 1
mov dword [ebp - 0xb8], eax
call dword [ebp + 0xc]
mov edi, dword [ebp - 0xc0]
mov edx, 0xc15730e2
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
sub esp, 8
mov ecx, dword [ebp - 0x88]
mov edx, 2
mov edi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [ebp - 0xb8], edx
mov dword [esp], ecx
call edi
mov ecx, dword [ebp - 0x78]
sub esp, 4
test ecx, ecx
setne al
cmp ecx, 0xffffffff
setne bl
test bl, al
jne 0x8c87ed
nop
lea edx, [ebp - 0xbc]
mov dword [esp], edx
call fcn.0080f7c4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ecx
mov edi, 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xb8], edi
call esi
sub esp, 4
jmp 0x8c8760
Function at 0x8eadc8
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
lea ebx, [ebp - 0x28]
mov esi, dword [ebp + 8]
lea edi, [esi + 8]
mov dword [esi], 0
call fcn.007b0de4
mov dword [esi + 4], eax
cld
xor eax, eax
mov ecx, 6
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, dword [edi]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.dll_GetDiskFreeSpaceExA
sub esp, 0x10
test eax, eax
je 0x8eae78
mov edi, dword [0x9f6098]
xor ebx, ebx
mov edx, dword [0x9f609c]
mov dword [esi], edi
xor edi, edi
mov dword [esi + 4], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov edx, eax
add edi, ecx
adc edx, ebx
xor ebx, ebx
mov dword [esi + 8], edi
xor edi, edi
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov edx, eax
add edi, ecx
adc edx, ebx
xor ebx, ebx
mov dword [esi + 0x10], edi
xor edi, edi
mov dword [esi + 0x14], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov edx, eax
add edi, ecx
mov eax, esi
adc edx, ebx
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 0x30], eax
mov eax, dword [0x9f60e8]
mov dword [esi + 0x18], 0
mov ecx, dword [ebp - 0x30]
mov dword [esi + 0x1c], 0
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x2c]
mov dword [esi + 0x10], 0
mov eax, esi
mov dword [esi], ecx
mov dword [esi + 4], ebx
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4

Function at 0x8eaf98
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov edx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
cmp eax, 0xffffffff
mov ecx, eax
je 0x8eafde
mov eax, dword [0x9f6098]
shr ecx, 4
mov edx, dword [0x9f609c]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov bl, cl
and bl, 1
cmp bl, 1
sbb eax, eax
add eax, 3
mov ebx, dword [ebp - 4]
leave
ret
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 0x10], eax
mov edx, dword [0x9f60e8]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
mov dword [ebx], eax
mov edx, dword [ebx]
mov dword [ebx + 4], ecx
cmp edx, 2
je 0x8eb048
cmp edx, 3
je 0x8eb048
cmp edx, 0x7b
je 0x8eb048
cmp edx, 0xf
je 0x8eb048
cmp edx, 0x57
je 0x8eb048
cmp edx, 0xa1
je 0x8eb048
cmp edx, 0x35
je 0x8eb048
xor eax, eax
cmp edx, 0x20
jne 0x8eafd9
mov ecx, dword [0x9f6098]
mov eax, 9
mov edx, dword [0x9f609c]
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov ebx, dword [ebp - 4]
leave
ret
mov eax, dword [0x9f6098]
mov ecx, dword [0x9f609c]
mov dword [ebx], eax
mov eax, 1
mov dword [ebx + 4], ecx
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x8eba98
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x40
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x20], 0
mov ebx, dword [ebp + 8]
call fcn.007b0de4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], 0
call fcn.007b0de4
mov dword [ebp - 0x24], eax
mov eax, dword [esi]
xor edx, edx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_CreateDirectoryA
sub esp, 8
test eax, eax
je 0x8ebb08
mov byte [ebp - 0x10], 1
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
mov eax, ebx
mov dword [ebx], esi
mov ecx, dword [ebp - 0x14]
mov byte [ebx + 8], 1
mov dword [ebx + 4], ecx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 0x30], eax
mov ecx, dword [0x9f60e8]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xb7
mov dword [ebp - 0x1c], edx
je 0x8ebb52
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
mov byte [ebp - 0x10], 0
mov dword [ebx], eax
mov esi, dword [ebp - 0x14]
mov byte [ebx + 8], 0
mov eax, ebx
mov dword [ebx + 4], esi
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4
mov dword [esp], esi
lea edx, [ebp - 0x28]
mov dword [esp + 4], edx
call fcn.008eaf98
cmp eax, 3
jne 0x8ebb73
mov eax, dword [0x9f6098]
mov edx, dword [0x9f609c]
jmp 0x8ebb2e
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
jmp 0x8ebb2e
Function at 0x8f72b8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [0x9ab98c]
test eax, eax
je 0x8f73c2
movzx eax, byte [0x9ab9a4]
test al, al
jne 0x8f73b3
mov eax, dword [0x9ab994]
mov esi, dword [0x9ab990]
cmp esi, eax
jbe 0x8f7309
mov ecx, dword [0x9ab9a8]
lea esi, [esi]
add eax, eax
lea edx, [ecx + 1]
cmp esi, eax
mov ecx, edx
ja 0x8f72f8
mov dword [0x9ab9a8], edx
lea eax, [esi + esi + 2]
xor edi, edi
mov dword [esp], eax
call fcn.0080e1c4
movzx ebx, word [0x9ab994]
mov dword [0x9ab9cc], eax
mov edx, eax
mov esi, dword [0x9ab990]
xor ecx, ecx
lea esi, [esi]
lea edi, [edi]
cmp ecx, ebx
jbe 0x8f7348
lea eax, [ebx + ebx]
movzx ebx, ax
lea eax, [edi + 1]
movzx edi, ax
mov word [edx], di
lea eax, [ecx + 1]
movzx ecx, ax
add edx, 2
cmp ecx, esi
jbe 0x8f7338
mov eax, dword [0x9ab9a8]
shl eax, 4
mov dword [esp], eax
call fcn.0080e1c4
mov dword [0x9ab9bc], eax
mov ecx, dword [0x9fad30]
test ecx, ecx
jne 0x8f741c
xor esi, esi
cmp esi, dword [0x9ab9a8]
jae 0x8f73b3
lea esi, [esi]
mov dword [esp], 4
mov eax, dword [0x9ab9bc]
mov ebx, esi
shl ebx, 4
inc esi
add ebx, eax
call fcn.0080e1c4
mov dword [ebx], eax
mov eax, dword [ebx]
mov dword [eax], 0
cmp esi, dword [0x9ab9a8]
jb 0x8f7388
mov byte [0x9ab9c0], 1
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.GLIBCXX_FORCE_NEW
mov eax, 8
mov edi, 0xff0
mov dword [0x9ab98c], eax
mov eax, pe_nt_image_headers32
mov esi, 0x1000
mov dword [0x9ab990], eax
mov ebx, 0xa
mov eax, 8
mov dword [0x9ab994], eax
mov dword [0x9ab998], edi
mov dword [0x9ab99c], esi
mov dword [0x9ab9a0], ebx
call sub.msvcrt.dll_getenv
test eax, eax
setne al
mov byte [0x9ab9a4], al
jmp 0x8f72d5
mov eax, dword [0x9ab99c]
mov ebx, 1
shl eax, 3
mov dword [esp], eax
call fcn.0080e1c4
cmp dword [0x9ab99c], 1
mov dword [0x9ab9b0], eax
jmp 0x8f7464
mov edx, dword [0x9ab9b0]
lea eax, [ebx*8]
mov ecx, dword [0x9ab9b0]
lea edx, [eax + edx]
add eax, ecx
mov dword [edx - 4], ebx
inc ebx
cmp dword [0x9ab99c], ebx
mov dword [edx - 8], eax
ja 0x8f743f
mov eax, dword [0x9ab9b0]
xor edx, edx
mov dword [eax + ebx*8 - 8], edx
mov eax, dword [0x9ab9b0]
mov dword [eax + ebx*8 - 4], ebx
mov dword [esp], 0x9ab9b4
call fcn.00810a24
mov dword [esp], 0x9ab9ac
mov eax, 0x8f7698
mov dword [esp + 4], eax
call fcn.00810934
mov dword [ebp - 0x10], 0
mov esi, dword [0x9ab99c]
xor eax, eax
inc esi
cmp eax, dword [0x9ab9a8]
jae 0x8f73b3
lea edi, [esi*4]
lea esi, [esi]
lea edi, [edi]
mov dword [esp], edi
mov edx, dword [ebp - 0x10]
mov eax, dword [0x9ab9bc]
shl edx, 4
lea ebx, [edx + eax]
call fcn.0080e1c4
mov dword [ebx], eax
mov dword [esp], edi
call fcn.0080e1c4
mov dword [ebx + 4], eax
mov dword [esp], edi
call fcn.0080e1c4
mov dword [ebx + 8], eax
mov dword [esp], 8
call fcn.0080e1c4
mov dword [ebx + 0xc], eax
mov dword [esp], eax
call fcn.00810a24
xor edx, edx
jmp 0x8f7536
mov eax, dword [ebx]
mov dword [eax + edx*4], 0
mov eax, dword [ebx + 4]
mov dword [eax + edx*4], 0
mov eax, dword [ebx + 8]
mov dword [eax + edx*4], 0
inc edx
cmp edx, esi
jb 0x8f7518
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [0x9ab9a8]
jb 0x8f74c8
jmp 0x8f73b3
Function at 0x8f7c38
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [0x9ab9d0]
test eax, eax
je 0x8f7d42
movzx eax, byte [0x9ab9e8]
test al, al
jne 0x8f7d33
mov eax, dword [0x9ab9d8]
mov esi, dword [0x9ab9d4]
cmp esi, eax
jbe 0x8f7c89
mov ecx, dword [0x9ab9ec]
lea esi, [esi]
add eax, eax
lea edx, [ecx + 1]
cmp esi, eax
mov ecx, edx
ja 0x8f7c78
mov dword [0x9ab9ec], edx
lea eax, [esi + esi + 2]
xor edi, edi
mov dword [esp], eax
call fcn.0080e1c4
movzx ebx, word [0x9ab9d8]
mov dword [0x9aba10], eax
mov edx, eax
mov esi, dword [0x9ab9d4]
xor ecx, ecx
lea esi, [esi]
lea edi, [edi]
cmp ecx, ebx
jbe 0x8f7cc8
lea eax, [ebx + ebx]
movzx ebx, ax
lea eax, [edi + 1]
movzx edi, ax
mov word [edx], di
lea eax, [ecx + 1]
movzx ecx, ax
add edx, 2
cmp ecx, esi
jbe 0x8f7cb8
mov eax, dword [0x9ab9ec]
shl eax, 4
mov dword [esp], eax
call fcn.0080e1c4
mov dword [0x9aba00], eax
mov ebx, dword [0x9fad30]
test ebx, ebx
jne 0x8f7d9b
xor esi, esi
cmp esi, dword [0x9ab9ec]
jae 0x8f7d33
lea esi, [esi]
mov dword [esp], 4
mov eax, dword [0x9aba00]
mov ebx, esi
shl ebx, 4
inc esi
add ebx, eax
call fcn.0080e1c4
mov dword [ebx], eax
mov eax, dword [ebx]
mov dword [eax], 0
cmp esi, dword [0x9ab9ec]
jb 0x8f7d08
mov byte [0x9aba04], 1
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.GLIBCXX_FORCE_NEW
mov eax, 8
mov edi, 0x1000
mov dword [0x9ab9d0], eax
mov eax, pe_nt_image_headers32
mov esi, 0xa
mov dword [0x9ab9d4], eax
mov eax, 8
mov dword [0x9ab9d8], eax
mov eax, 0xff0
mov dword [0x9ab9dc], eax
mov dword [0x9ab9e0], edi
mov dword [0x9ab9e4], esi
call sub.msvcrt.dll_getenv
test eax, eax
setne al
mov byte [0x9ab9e8], al
jmp 0x8f7c55
mov eax, dword [0x9ab9e0]
mov ebx, 1
shl eax, 3
mov dword [esp], eax
call fcn.0080e1c4
cmp dword [0x9ab9e0], 1
mov dword [0x9ab9f4], eax
jmp 0x8f7de3
mov edx, dword [0x9ab9f4]
lea eax, [ebx*8]
mov ecx, dword [0x9ab9f4]
lea edx, [eax + edx]
add eax, ecx
mov dword [edx - 4], ebx
inc ebx
cmp dword [0x9ab9e0], ebx
mov dword [edx - 8], eax
ja 0x8f7dbe
mov eax, dword [0x9ab9f4]
xor ecx, ecx
mov dword [eax + ebx*8 - 8], ecx
mov eax, dword [0x9ab9f4]
mov dword [eax + ebx*8 - 4], ebx
mov dword [esp], 0x9ab9f8
call fcn.00810a24
mov dword [esp], 0x9ab9f0
mov edx, 0x8f8018
mov dword [esp + 4], edx
call fcn.00810934
mov dword [ebp - 0x10], 0
mov esi, dword [0x9ab9e0]
xor eax, eax
inc esi
cmp eax, dword [0x9ab9ec]
jae 0x8f7d33
lea edi, [esi*4]
lea esi, [esi]
lea edi, [edi]
mov dword [esp], edi
mov edx, dword [ebp - 0x10]
mov eax, dword [0x9aba00]
shl edx, 4
lea ebx, [edx + eax]
call fcn.0080e1c4
mov dword [ebx], eax
mov dword [esp], edi
call fcn.0080e1c4
mov dword [ebx + 4], eax
mov dword [esp], edi
call fcn.0080e1c4
mov dword [ebx + 8], eax
mov dword [esp], 8
call fcn.0080e1c4
mov dword [ebx + 0xc], eax
mov dword [esp], eax
call fcn.00810a24
xor edx, edx
jmp 0x8f7eb6
mov eax, dword [ebx]
mov dword [eax + edx*4], 0
mov eax, dword [ebx + 4]
mov dword [eax + edx*4], 0
mov eax, dword [ebx + 8]
mov dword [eax + edx*4], 0
inc edx
cmp edx, esi
jb 0x8f7e98
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [0x9ab9ec]
jb 0x8f7e48
jmp 0x8f7d33
Function at 0x4041e2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ecx
and dword [ecx + 0x28], 0
lea eax, [ecx + 0xc]
push eax
push 0
push dword [ecx + 0x24]
push dword [ecx + 0x20]
push dword [ecx + 8]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
jne 0x404242
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x3e5
je 0x404242
cmp eax, 0xea
je 0x404242
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x40423e
test byte [ecx + 0x1c], 1
je 0x40423e
push eax
push dword [ecx + 0x14]
mov edx, 0x401688
push dword [ecx + 0x10]
push 0x1e
pop ecx
call fcn.00402cac
xor al, al
pop ecx
ret
mov al, 1
pop ecx
ret
Function at 0x40477d
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov edx, ecx
push edi
mov dword [ebp - 4], edx
mov eax, dword [section..data]
mov edi, dword [ebp + 0xc]
cmp eax, section..data
je 0x4047ba
test byte [eax + 0x1c], 2
je 0x4047ba
push edi
push edx
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2f
pop ecx
call fcn.00403943
mov eax, dword [section..data]
mov edx, dword [ebp - 4]
cmp edi, 0x28
jae 0x4047f4
mov ebx, 0x401688
cmp eax, section..data
je 0x4047e7
test byte [eax + 0x1c], 1
je 0x4047e7
push edi
push dword [eax + 0x14]
mov edx, ebx
push dword [eax + 0x10]
push 0x30
pop ecx
call fcn.00402cac
mov eax, dword [section..data]
mov edi, dword [ebp - 4]
mov esi, 0x80070057
jmp 0x40492c
mov ecx, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ecx], edi
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
push ecx
push dword [edx + 8]
mov dword [ebp - 0xc], ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
mov ebx, 0x401688
test eax, eax
jne 0x4048d5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x3e5
je 0x404883
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40484e
movzx esi, si
or esi, 0x80070000
mov eax, dword [section..data]
cmp eax, section..data
je 0x404876
test byte [eax + 0x1c], 1
je 0x404876
push esi
push dword [eax + 0x14]
mov edx, ebx
push dword [eax + 0x10]
push 0x31
pop ecx
call fcn.00402cac
mov eax, dword [section..data]
mov edi, dword [ebp - 4]
test esi, esi
js 0x40492c
jmp 0x4048d8
mov edi, dword [ebp - 4]
push 0xffffffffffffffff
push dword [edi + 4]
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x4048d8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4048ab
movzx esi, si
or esi, 0x80070000
mov eax, dword [section..data]
cmp eax, section..data
je 0x404879
test byte [eax + 0x1c], 1
je 0x404879
push esi
push dword [eax + 0x14]
mov edx, ebx
push dword [eax + 0x10]
push 0x32
pop ecx
call fcn.00402cac
mov eax, dword [section..data]
jmp 0x404879
mov edi, dword [ebp - 4]
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [edi + 8]
call dword [sym.imp.api_ms_win_core_io_l1_1_0.dll_GetOverlappedResult]
test eax, eax
jne 0x404927
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x404904
movzx esi, si
or esi, 0x80070000
mov eax, dword [section..data]
cmp eax, section..data
je 0x40494b
test byte [eax + 0x1c], 1
je 0x40492c
push esi
push dword [eax + 0x14]
mov edx, ebx
push dword [eax + 0x10]
push 0x33
pop ecx
call fcn.00402cac
mov eax, dword [section..data]
cmp eax, section..data
je 0x40494b
test byte [eax + 0x1c], 2
je 0x40494b
push esi
push edi
push dword [eax + 0x14]
mov edx, ebx
push dword [eax + 0x10]
push 0x34
pop ecx
call fcn.00403a41
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x407525
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x407562
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x40755b
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x407567
add edx, 0x28
cmp edx, esi
jne 0x40754c
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x407564
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..pdata
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x5d875928
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..pdata_1
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x28124d8a
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x1002f070
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100beff1
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x100dc040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edx]
xorps xmm0, xmm0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x4c], 0
mov dword [ecx + 0x50], 0
mov dword [ecx + 0x54], 0
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x5c], 0
mov dword [ecx + 0x60], 0
mov dword [ecx + 0x64], 0
mov dword [ecx + 0x68], 0
mov dword [ecx + 0x70], 0
mov dword [ecx + 0x74], 0
mov dword [ecx + 0x78], 0
mov dword [ecx + 0x7c], 0
mov dword [ecx + 0x80], 0
mov dword [ecx + 0x84], 0
movups xmmword [ecx + 0x90], xmm0
mov dword [ecx + 0xa0], 0
mov dword [ecx + 0xa4], 0xf
mov dword [ebp - 0x10], ecx
mov byte [ecx + 0x90], 0
mov dword [ebp - 4], 0
movups xmmword [ecx + 0xa8], xmm0
mov dword [ecx + 0xb8], 0
mov dword [ecx + 0xbc], 0xf
mov byte [ecx + 0xa8], 0
mov byte [ebp - 4], 1
mov word [ecx + 0xc1], 0
mov byte [ecx + 0xc3], 0
mov dword [ecx + 0xc0], 0
mov dword [ecx + 0x400], 0
mov dword [ecx + 0x404], 0
mov dword [ecx + 0x408], 0
mov dword [ecx + 0x40c], 0
mov dword [ecx + 0x410], 0
mov dword [ecx + 0x414], 0
mov dword [ecx + 0x418], 0
mov dword [ecx + 0x41c], 0
mov byte [ecx + 0x420], 0
push eax
mov byte [ecx + 0x3424], 0
mov dword [ecx + 0x3428], 0
mov dword [ecx + 0x342c], 0
mov dword [ecx + 0x3430], 0
mov dword [ecx + 0x3434], 0
mov dword [ecx + 0x3438], 0
mov dword [ecx + 0x343c], 0
mov byte [ecx + 0x344d], 0
mov byte [ecx + 0x3458], 0
mov byte [ecx + 0x3744], 0
mov dword [ecx + 0x3748], 0
mov dword [ecx + 0x374c], 0
mov dword [ecx + 0x3750], 0
mov dword [ecx + 0x3754], 0
mov dword [ecx + 0x3758], 0
mov dword [ecx + 0x375c], 0
mov byte [ecx + 0x3764], 0
mov dword [ecx + 0x3774], 0
mov byte [ecx + 0x377a], 0
mov dword [ecx + 0x377c], 0
mov dword [ecx + 0x3780], 0
call fcn.10025f80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret