joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416e22
Capabilities:
Get common file path

Disassembly:
mov eax, 0x430b51
call fcn.00430290
sub esp, 0x664
push ebx
push esi
push edi
xor esi, esi
mov edi, ecx
xorps xmm0, xmm0
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x25c], esi
movlpd qword [ebp - 0x38], xmm0
call fcn.0040dee6
mov dword [ebp - 4], esi
mov eax, ecx
push dword [edi + 0x646]
push dword [edi + 0x642]
push ecx
push 0x83
push eax
mov ecx, edi
call fcn.0041790e
test eax, eax
je 0x417037
mov dword [ebp - 0x14], esi
cmp dword [edi + 0x64a], esi
jle 0x417037
mov eax, dword [ebp - 0x34]
mov ecx, esi
mov ebx, dword [ebp - 0x38]
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x416ef8
mov eax, dword [ebp - 0x2c]
add eax, ebx
push 0x418
push eax
lea eax, [ebp - 0x670]
push eax
call fcn.004198d0
lea eax, [ebp - 0x466]
push 0x43fc38
push eax
call fcn.0041fb97
add esp, 0x14
test eax, eax
jne 0x416ece
xor ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
jmp 0x416ee1
mov eax, dword [ebp - 0x25c]
mov ecx, dword [ebp - 0x18]
add eax, 0x418
add ebx, eax
adc dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, dword [edi + 0x64a]
jl 0x416e93
test ecx, ecx
je 0x417037
lea ecx, [ebp - 0x44]
call fcn.0040dee6
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
mov eax, ecx
push eax
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x25c]
add eax, 0x418
add eax, ebx
push eax
call fcn.00417064
test eax, eax
je 0x41702d
lea ecx, [edi + 0x12dc]
call fcn.0040ef32
push esi
lea edx, [ebp - 0x258]
mov ecx, eax
call fcn.00402d88
mov dword [ebp - 0x10], esi
lea eax, [ebp - 0x670]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x258]
mov ebx, str._s_s
push eax
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.0040f523
add esp, 0x14
lea ecx, [ebp - 0x24]
call fcn.00412148
push esi
push 0x10000000
push 2
push esi
push 0x40000000
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.0040ef32
push eax
lea ecx, [ebp - 0x24]
call fcn.004121f2
test eax, eax
jne 0x416fe8
lea eax, [ebp - 0x258]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x670]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.0040f523
add esp, 0x10
lea ecx, [ebp - 0x10]
push esi
push 0x10000000
push 2
push esi
push 0x40000000
call fcn.0040ef32
push eax
lea ecx, [ebp - 0x24]
call fcn.004121f2
test eax, eax
je 0x41701d
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
push dword [ebp - 0x40]
call fcn.0041227b
test eax, eax
je 0x41701d
lea ecx, [ebp - 0x24]
call fcn.0041222a
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
xor ebx, ebx
inc ebx
push eax
mov dword [edi + 0x12f8], ebx
call fcn.0040f1ac
mov esi, ebx
lea ecx, [ebp - 0x24]
call fcn.00412159
lea ecx, [ebp - 0x10]
call fcn.0040eea9
lea ecx, [ebp - 0x44]
call fcn.0040def7
jmp 0x417049
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x222]
push eax
call fcn.0040f1c4
xor esi, esi
inc esi
lea ecx, [ebp - 0x30]
call fcn.0040def7
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x4173d1
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [0x447280], 0
push ebx
push esi
push edi
mov edi, ecx
jne 0x4174a8
xor ebx, ebx
mov dword [edi + 0x12e0], ebx
cmp dword [edi + 0x65e], ebx
jne 0x4174a8
lea ecx, [edi + 0x12dc]
call fcn.0040ef32
lea ecx, [ebp - 0x20c]
xor edx, edx
push ecx
mov ecx, eax
call fcn.00402d88
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi + 0x12e0], eax
test eax, eax
je 0x4174b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4174b2
lea eax, [edi + 0x12e4]
xor ecx, ecx
push eax
lea eax, [ebp - 0x20c]
inc ecx
push eax
call fcn.0041498e
mov dword [edi + 0x12e8], eax
pop ecx
pop ecx
test eax, eax
je 0x4174a8
push 0xffffffffffffffff
push dword [edi + 0x12e0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push 4
push eax
push dword [edi + 0x12e8]
call fcn.004198d0
add esp, 0xc
push dword [edi + 0x12e0]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
lea eax, [edi + 0x12e4]
xor ecx, ecx
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0041498e
mov dword [edi + 0x12e8], eax
pop ecx
pop ecx
test eax, eax
je 0x417533
push 0xffffffffffffffff
push dword [edi + 0x12e0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [edi + 0x12e8]
push dword [edi + 0x12e0]
mov esi, dword [eax]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, edi
call fcn.004166b6
push esi
call fcn.004171e4
mov esi, eax
test esi, esi
je 0x417533
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 3
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 8]
or dword [eax], 0xffffffff
xor eax, eax
jmp 0x4174ab
mov eax, dword [edi + 0x12e0]
test eax, eax
je 0x417544
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi]
mov ecx, edi
push str.Cette_application_ne_peut_pas
call dword [eax + 4]
jmp 0x417526
Function at 0x417552
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x430a92
call fcn.00430290
sub esp, 0x644
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x2c]
call fcn.0040dee6
and dword [ebp - 4], 0
mov eax, ecx
push dword [edi + 0x646]
push dword [edi + 0x642]
push ecx
push 0x83
push eax
mov ecx, edi
call fcn.0041790e
test eax, eax
je 0x4168f7
lea ecx, [edi + 0x12dc]
call fcn.0040ef32
push 0
lea edx, [ebp - 0x238]
mov ecx, eax
call fcn.00402d88
mov eax, dword [edi + 0x64e]
xorps xmm0, xmm0
add eax, dword [edi + 0x64a]
and dword [ebp - 0x18], 0
movlpd qword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], eax
pop ecx
test eax, eax
jle 0x4168ae
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x650]
push 0x418
add esi, ebx
push esi
push eax
call fcn.004198d0
add esp, 0xc
lea eax, [ebp - 0x238]
mov ecx, edi
push eax
lea eax, [esi + 0x418]
push eax
lea eax, [ebp - 0x650]
push eax
call fcn.00416912
test eax, eax
je 0x4168f7
mov eax, dword [ebp - 0x23c]
add eax, 0x418
add ebx, eax
mov eax, dword [ebp - 0x18]
adc dword [ebp - 0x14], 0
inc eax
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x10]
jl 0x416857
call fcn.00401723
lea edi, [eax + 4]
lea eax, [ebp - 0x238]
mov ecx, edi
push eax
call fcn.0040f1c4
mov ecx, edi
call fcn.0040f19b
dec eax
lea edx, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.0040f29d
mov esi, eax
xor ebx, ebx
mov ecx, edi
inc ebx
mov byte [ebp - 4], bl
call fcn.0040eed5
mov ecx, dword [esi]
mov dword [edi], ecx
lea ecx, [ebp - 0x10]
and dword [esi], 0
call fcn.0040eea9
jmp 0x4168f9
xor ebx, ebx
lea ecx, [ebp - 0x2c]
call fcn.0040def7
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
push ecx
push esi
push edi
push 0xc
mov edi, ecx
call fcn.004188f8
pop ecx
mov ecx, eax
mov dword [esp + 8], eax
call fcn.0040dee6
push dword [edi + 0x652]
mov dword [edi + 0x1308], eax
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 4]
push str.INFOEXE
push 0x7d
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [edi + 0x652]
mov ecx, dword [edi + 0x1308]
push eax
push dword [ecx + 4]
call fcn.004198d0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, edi
pop edi
pop esi
add esp, 4
jmp 0x4167cf
Function at 0x417a54
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x4306a9
call fcn.00430290
sub esp, 0xc
push ebx
push esi
xor eax, eax
push edi
mov edi, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
push str.FILEPATH
mov byte [ebp - 4], 2
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0x6d
push dword [edi + 4]
call ebx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
call fcn.004069bd
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push str.FILEPATH
push 0x6e
push dword [edi + 4]
call ebx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
lea ecx, [ebp - 0x18]
call fcn.0040f1c4
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push str.FILEPATH
push 0x6f
push dword [edi + 4]
call ebx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040f1c4
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea ecx, [ebp - 0x14]
call fcn.0040ef32
lea ecx, [ebp - 0x18]
mov edx, eax
call fcn.0040ef32
mov ecx, eax
call fcn.004069cb
push str.FILEPATH
push 0x70
push dword [edi + 4]
call ebx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040f1c4
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x417b6e
xor ecx, ecx
cmp word [eax], cx
je 0x417b6e
lea ecx, [ebp - 0x10]
call fcn.0040ef32
mov ecx, eax
call fcn.00406a7a
push str.INFOEXE
push 0x7f
push dword [edi + 4]
call ebx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
test edi, edi
je 0x417ba1
mov ecx, dword [edi]
call fcn.00406aa2
lea ecx, [ebp - 0x10]
call fcn.0040eea9
lea ecx, [ebp - 0x14]
call fcn.0040eea9
lea ecx, [ebp - 0x18]
call fcn.0040eea9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42c0b4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042bd74
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x101f0b84
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x14640b84
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x1bd046db
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x327c7a31
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x432072
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x2d820536
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
mov eax, section..text_1
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x483447a0
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x10017b19
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10017b30
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x10017b45
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x8bbca631
mov esp, ebp
pop ebp
ret

Function at 0x10017ef0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10017f42
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.10019143
mov ecx, eax
call fcn.10018cce
jmp 0x10017f65
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10017f65
push 0x207c
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret
Function at 0x10018b97
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10018bb7
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x10018c02
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10018be5
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10018c02
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10018f28
mov dword [eax], 0xf0ea75c9
jmp 0x10018bda
mov esp, ebp
pop ebp
ret
Function at 0x1001cf30
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001cf85
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 4]
call fcn.10018f28
mov esi, eax
mov eax, dword [ebp - 0x18]
push dword [eax]
mov ecx, dword [ebp - 4]
call fcn.10018f28
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1001cfa3
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1001cfa3
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001f07a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001f0cf
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1001f0aa
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jl 0x1001f0cd
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001f0cb
push 0x207c
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1001f09f
jmp 0x1001f0e3
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
and dword [eax], 0
mov esp, ebp
pop ebp
ret

Function at 0x1001f602
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001f62f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001f62d
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x1001f63e
push 0
push 0xc0a
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
mov esp, ebp
pop ebp
ret
Function at 0x1002b7a4
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002b7cb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x1002b7df
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002b7df
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esp, ebp
pop ebp
ret

Function at 0x1002dfbe
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002dfd8
push 0x207c
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1002dfe7
push 0
push 0x25fa
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
pop ebp
ret
Function at 0x10032819
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1003283d
xor eax, eax
jmp 0x10032980
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1003285b
xor eax, eax
jmp 0x10032980
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
push 1
push 0x32b3
call fcn.10032283
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x1003287e
xor eax, eax
jmp 0x10032980
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x10af
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
push 0x7403
lea eax, [ebp - 0x10]
push eax
call fcn.100325b6
add esp, 0x20
push dword [ebp + 8]
push dword [ebp - 8]
push 0x3392
push 0x6292
push dword [ebp - 4]
push 1
call fcn.10029ade
add esp, 0x18
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x14]
push eax
call fcn.10032673
add esp, 0x10
cmp dword [ebp - 0x14], 0
je 0x10032905
lea eax, [ebp - 4]
push eax
push 0x4a1
push 1
push 0x59b1
push 0x4b07
push 0x5063
lea eax, [ebp - 0x14]
push eax
call fcn.100326d8
add esp, 0x1c
push dword [ebp - 4]
call fcn.100313d6
pop ecx
test eax, eax
jne 0x10032916
xor eax, eax
jmp 0x10032980
push 1
lea eax, [ebp - 4]
push eax
call fcn.100327a6
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10032968
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x10032942
xor eax, eax
jmp 0x10032980
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1003295b
xor eax, eax
jmp 0x10032980
push 1
lea eax, [ebp - 4]
push eax
call fcn.100327e6
pop ecx
pop ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10032979
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1003297d
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1004944e
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100494e6
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 2
jmp 0x100494a6
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl 0x100494e4
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100494c4
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jg 0x100494e2
mov eax, dword [ebp - 0x1c]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.10018f28
cmp dword [eax], 0
je 0x100494e0
jmp 0x100494e2
jmp 0x100494b9
jmp 0x1004949b
jmp 0x100494ee
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esp, ebp
pop ebp
ret